CVE-2025-13065
BaseFortify
Publication date: 2025-12-06
Last updated on: 2025-12-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | starter_templates | 4.4.41 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Starter Templates plugin for WordPress allows authenticated users with author-level access or higher to upload arbitrary files due to insufficient file type validation. Specifically, the plugin fails to properly detect WXR files and allows files with double extensions to bypass sanitization, which can lead to the upload of malicious files.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with author-level access to upload arbitrary files to the server hosting the WordPress site. This may lead to remote code execution, potentially compromising the entire site, leading to data theft, site defacement, or further attacks on the server.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for the presence of files with double extensions (e.g., *.wxr.php) uploaded via the Starter Templates plugin import functionality. Since the vulnerability involves arbitrary file uploads bypassing file type validation, you can search your WordPress uploads directory or plugin directories for suspicious files with double extensions or unexpected file types. For example, on a Linux server, you might use commands like: `find /path/to/wordpress/wp-content/uploads -type f -name '*.wxr.php'` or `find /path/to/wordpress/wp-content/plugins/starter-templates-importer -type f -regex '.*\.wxr\..*'` to locate files with double extensions. Additionally, reviewing web server logs for POST requests to the import endpoints of the Starter Templates plugin by authenticated users with author-level access or higher may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Starter Templates plugin to version 4.4.42 or later, which includes fixes that enforce strict file type validation, prevent double extension attacks, and sanitize imported file content to block arbitrary file uploads. If updating immediately is not possible, restrict author-level and higher user permissions temporarily to prevent exploitation, and monitor for suspicious file uploads or activity related to the plugin's import functionality. Additionally, ensure that PHP output buffering and compression settings are configured as per the patch to avoid bypasses during import processing. [1]