Cyber Resilience

CVE-2025-22654

Critical

Published: 18 February 2025

Published
18 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0699 91.7th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22654 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22654 is an unrestricted file upload vulnerability of dangerous type, tracked as CWE-434, that affects the Simplified WordPress plugin by kodeshpa. The flaw exists in all versions from n/a through 1.0.6 and carries a CVSS 3.1 score of 10.0 reflecting network attack vector, low complexity, no required privileges or user interaction, and changed scope with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can upload arbitrary malicious files to the affected WordPress site and leverage them to achieve code execution or full system compromise.

The Patchstack advisory at the referenced URL documents the arbitrary file upload issue in the plugin and is the primary public source for remediation guidance.

The associated EPSS score sits at 0.0818 with no material increase from its peak value.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: from n/a through <= 1.0.6.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload in public-facing WordPress plugin directly enables T1190 (exploiting public-facing app) and facilitates T1505.003 (uploading/deploying web shell for RCE).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely patching or removal of the vulnerable Simplified WordPress plugin versions up to 1.0.6.

SI-10 Information Input Validation good match
prevent

Enforces validation of uploaded files to reject dangerous types and malicious content, preventing exploitation of the unrestricted file upload vulnerability.

SI-3 Malicious Code Protection good match
preventdetect

Deploys malicious code protection at upload entry points to scan and block dangerous files, countering the impacts of successful uploads.

References