CVE-2025-3616
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 22, 2025
Updated: Apr 23, 2025
CWE ID 434
Summary
CVE-2025-3616 is a vulnerability affecting the Greenshift plugin for WordPress. This issue, present in versions 11.4 to 11.4.5, stems from missing file type validation in the gspb_make_proxy_api_request() function. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to upload arbitrary files, potentially enabling remote code execution. The arbitrary file upload was patched in 11.4.5, but an additional capability check was introduced in 11.4.6 to prevent unauthorized limited file uploads.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Greenshift Plugin
Affected Vendors
- WordPress