Cyber Resilience

CVE-2025-23953

Critical

Published: 22 January 2025

Published
22 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0028 51.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23953 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-23953 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Scriptonite User Files WordPress plugin, affecting all versions up to and including 2.4.2. The flaw allows attackers to upload a web shell directly to the web server, bypassing restrictions on dangerous file types.

With a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation grants attackers the ability to upload and execute arbitrary malicious files, such as web shells, enabling full server compromise with high impacts on confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/user-files/vulnerability/wordpress-user-files-plugin-2-4-2-arbitrary-file-upload-vulnerability?_s_id=cve details this as an arbitrary file upload issue in the WordPress User Files plugin version 2.4.2, recommending that practitioners update to a patched version or implement mitigations as outlined to prevent exploitation.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects user files: from n/a through <= 2.4.2.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress plugin enables direct exploitation (T1190) and arbitrary web shell upload/execution (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the unrestricted file upload flaw in the Scriptonite User Files WordPress plugin by requiring timely patching to versions beyond 2.4.2.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by enforcing validation of uploaded file types, extensions, and content to block dangerous web shells at system entry points.

SI-3 Malicious Code Protection good match
preventdetect

Detects and eradicates malicious code such as uploaded web shells on the web server, mitigating server compromise post-upload.

References