CVE-2025-58819
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| creedally | bulk_featured_image | 1.2.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the WordPress Bulk Featured Image Plugin (versions up to 1.2.2) allows an attacker with administrator privileges to upload any type of file to the website, including dangerous files like web shells. These malicious files can then be executed on the server, enabling the attacker to gain unauthorized access and control over the website. It is classified as an Arbitrary File Upload vulnerability and falls under the OWASP Top 10 category A5: Security Misconfiguration. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow attackers to upload and execute malicious backdoors on your web server, leading to unauthorized access, data theft, website defacement, or further compromise of your server environment. It poses a high risk to the confidentiality, integrity, and availability of your website and server, as indicated by its high CVSS score of 9.1. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves scanning the server for uploaded malicious files such as web shells. Since plugin-based malware scanners are often unreliable, it is recommended to perform server-side malware scanning or engage professional incident response services. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation includes applying virtual patching (vPatching) provided by Patchstack, which auto-mitigates the vulnerability without an official patch. Additionally, users should monitor for unauthorized file uploads and consider professional incident response if compromise is suspected. Since no fixed plugin version exists yet, these steps are critical. [1]