CVE-2025-3616
Published: 22 April 2025
Summary
CVE-2025-3616 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Greenshiftwp Greenshift - Animation And Page Builder Blocks. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 21.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Greenshift animation and page builder blocks plugin for WordPress contains an arbitrary file upload vulnerability in versions 11.4 through 11.4.5. The flaw stems from missing file type validation inside the gspb_make_proxy_api_request function, which permits unauthenticated file writes to the server when invoked through the plugin's proxy API endpoint. The issue is tracked as CWE-434 and carries a CVSS 3.1 score of 8.8.
Authenticated attackers holding Subscriber or higher privileges can exploit the weakness to upload arbitrary files, including executable code, thereby achieving remote code execution on the affected WordPress site. The upload occurs without sufficient server-side checks, allowing an attacker to place malicious content in a web-accessible directory.
The arbitrary file upload vector was addressed in version 11.4.5, while version 11.4.6 added an explicit capability check to block unauthorized limited file uploads. Wordfence and the plugin's Trac records document the changesets that introduced the validation and permission fixes.
EPSS scores have remained low, with a current value of 0.0114 and a peak of 0.0146.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12330
Vulnerability details
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with…
more
Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.