Cyber Resilience

CVE-2025-48300

Critical

Published: 16 July 2025

Published
16 July 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0038 59.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48300 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).

Deeper analysis

CVE-2025-48300 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Groundhogg WordPress plugin developed by Adrian Tobey. The flaw affects Groundhogg versions from n/a through 4.2.1 and enables attackers to upload web shells to the web server.

Exploitation is network-accessible with low complexity and no user interaction required, but demands high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1). Privileged users, such as administrators, can upload dangerous files like web shells, achieving high impacts on confidentiality, integrity, and availability with a scope change, potentially resulting in full server compromise.

The Patchstack advisory provides further details on this arbitrary file upload vulnerability in Groundhogg 4.2.1 at https://patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-4-2-1-arbitrary-file-upload-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows Upload a Web Shell to a Web Server.This issue affects Groundhogg: from n/a through <= 4.2.1.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload vulnerability in public-facing WordPress plugin directly enables initial access via exploitation (T1190) and web shell deployment for persistence/execution (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of uploaded files to ensure only safe content is accepted, directly preventing unrestricted upload of dangerous types like web shells.

SI-9 Information Input Restrictions good match
prevent

Restricts file upload inputs to organization-defined safe types and sizes, blocking dangerous files such as web shells from being uploaded.

SI-3 Malicious Code Protection good match
preventdetect

Deploys malicious code protection to scan and block web shells at upload or execution, mitigating the impact of unrestricted file uploads.

References