Cyber Resilience

CVE-2025-22504

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0047 37.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-22504 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22504 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the 4ECPS Web Forms WordPress plugin by jumpdemand. This issue affects all versions of the 4ecps-webforms plugin up to and including 0.2.18, enabling attackers to upload a web shell directly to the web server.

The vulnerability carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction required, while changing scope to achieve high impacts across confidentiality, integrity, and availability. Unauthenticated attackers can leverage this flaw to upload malicious files, such as web shells, potentially resulting in arbitrary code execution and full server compromise.

Patchstack's advisory documents this as an arbitrary file upload vulnerability specifically in 4ECPS Web Forms plugin version 0.2.18, available at https://patchstack.com/database/Wordpress/Plugin/4ecps-webforms/vulnerability/wordpress-4ecps-web-forms-plugin-0-2-18-arbitrary-file-upload-vulnerability?_s_id=cve. Security practitioners should consult this reference for detailed mitigation steps.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through <= 0.2.18.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Direct arbitrary file upload to public-facing WordPress plugin enables web shell deployment (T1100) after exploiting the exposed application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-50002Shared CWE-434
CVE-2015-10135Shared CWE-434
CVE-2025-69312Shared CWE-434
CVE-2015-10144Shared CWE-434
CVE-2025-7852Shared CWE-434
CVE-2025-44658Shared CWE-434
CVE-2026-37748Shared CWE-434
CVE-2025-49387Shared CWE-434
CVE-2025-6058Shared CWE-434
CVE-2026-6518Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of file upload inputs to block dangerous types like web shells, addressing the core unrestricted upload vulnerability.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of the specific flaw in the 4ECPS Web Forms plugin, enabling timely patching to eliminate the vulnerability.

SI-3 Malicious Code Protection partial match
preventdetect

Deploys malicious code protection at web upload entry points to scan and block web shells attempting to be uploaded to the server.

References