CVE-2025-0394
Published: 14 January 2025
Summary
CVE-2025-0394 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Groundhogg WordPress plugin for CRM, email, and marketing automation is affected by an arbitrary file upload vulnerability in all versions through 3.7.3.5. The flaw stems from absent file type validation inside the gh_big_file_upload function, which permits upload of files of any type and is tracked as CWE-434.
Authenticated attackers holding Author or higher privileges can exploit the issue over the network to place arbitrary files on the server, potentially achieving remote code execution with a CVSS 3.1 score of 8.8.
References to the vulnerable code, a changeset, the plugin developer page, and a detailed Wordfence advisory indicate that updated versions have been published in the WordPress repository to address the missing validation.
The EPSS score rose from a low baseline to a peak of 0.0909, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1641
Vulnerability details
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including,…
more
3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables web shell deployment for RCE (T1505.003) after exploiting the vulnerable application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of file types and content in uploads, addressing the missing file type validation in the gh_big_file_upload() function that enables arbitrary file uploads.
Mandates timely flaw remediation, such as patching the Groundhogg plugin beyond version 3.7.3.5 to eliminate the arbitrary file upload vulnerability.
Deploys malicious code protection mechanisms to scan for and block execution of dangerous uploaded files, mitigating RCE risk post-upload.