CVE-2025-24650
Published: 24 January 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2025-24650 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Themefic Tourfic WordPress plugin. This issue affects Tourfic versions from n/a through 2.15.3 and allows attackers to upload a web shell to the web server. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Exploitation requires network access, low complexity, and high privileges such as administrator-level access, with no user interaction needed. A successful attack changes scope and achieves high impacts across confidentiality, integrity, and availability, enabling attackers to gain remote code execution and full control over the web server via the uploaded web shell.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-15-3-arbitrary-file-upload-vulnerability?_s_id=cve details this arbitrary file upload vulnerability in the Tourfic plugin version 2.15.3.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Arbitrary file upload vuln in public-facing WordPress plugin directly enables web shell deployment (T1100) via exploitation of the application (T1190).