CVE-2025-49250
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Code Injection issue in the WordPress Team Showcase plugin (versions prior to 25.05.13) that allows a malicious user with Subscriber-level privileges to inject arbitrary content into website pages and posts. This can enable attackers to insert phishing pages or other malicious content into the site. It is classified as Content Injection and falls under OWASP Top 10 A3: Injection. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow attackers to inject malicious content such as phishing pages into your website, potentially compromising your site's integrity and trustworthiness. Although the severity is considered low and exploitation is unlikely, it can still lead to security risks including user deception and potential damage to your website's reputation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the WordPress Team Showcase plugin version is below 25.05.13. Additionally, monitoring for arbitrary shortcode execution or unexpected content injection in website pages and posts can indicate exploitation. While no specific commands are provided, scanning the plugin version via WordPress CLI (e.g., `wp plugin get team-showcase --field=version`) and performing server-side malware scans are recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WordPress Team Showcase plugin to version 25.05.13 or later. If an update is not immediately possible, applying virtual patching (vPatching) offered by Patchstack can provide rapid protection. Additionally, conducting professional incident response and server-side malware scanning is advised if compromise is suspected. [1]