CVE-2025-2249
Published: 29 March 2025
Summary
CVE-2025-2249 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The SoJ SoundSlides plugin for WordPress is affected by an arbitrary file upload vulnerability stemming from missing file type validation in the soj_soundslides_options_subpanel() function. The issue impacts all versions through 1.2.2 and is tracked as CVE-2025-2249 with a CVSS 3.1 score of 8.8 and CWE-434.
Authenticated users holding Contributor privileges or higher can exploit the flaw over the network to upload arbitrary files to the server, which may enable remote code execution and full site compromise.
The current EPSS score of 0.0076 reflects a material rise from its initial low value to a recorded peak of 0.0176, indicating that exploitation interest emerged after public disclosure. Details are available in the Wordfence advisory and the plugin source repository on WordPress Trac.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8673
Vulnerability details
The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel() function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access…
more
and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications for initial access (T1190) and facilitates deployment of web shells to achieve remote code execution (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type validation in the soj_soundslides_options_subpanel() function by requiring input validation mechanisms at upload points to prevent arbitrary file uploads.
Mandates identification, reporting, and correction of flaws like this arbitrary file upload vulnerability in the WordPress plugin to eliminate the root cause.
Implements malicious code protection at system entry points such as file uploads to block or detect dangerous files that could lead to remote code execution.