CVE-2025-4954
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-07-02
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axlethemes | axle_demo_importer | to 1.0.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Axle Demo Importer WordPress plugin up to version 1.0.3. It occurs because the plugin does not validate files uploaded by authenticated users with author-level permissions or higher. As a result, these users can upload arbitrary files, including potentially malicious PHP scripts, to the server. [1]
How can this vulnerability impact me? :
The vulnerability can allow authenticated users with author or higher permissions to upload arbitrary files such as PHP scripts to the server. This could lead to unauthorized code execution, server compromise, data theft, or other malicious activities depending on the uploaded file's intent. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for the presence of the Axle Demo Importer WordPress plugin version 1.0.3 or earlier installed on your system. Since the vulnerability allows authenticated users with author-level permissions or higher to upload arbitrary files, monitoring for unexpected or suspicious PHP files in upload directories may help. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting author-level and higher user permissions to trusted users only, monitoring and removing any suspicious uploaded files, and disabling or removing the Axle Demo Importer plugin until a fix is available. Since there is currently no known fix, users should be cautious about allowing file uploads via this plugin. [1]