CVE-2025-6423
Published: 12 July 2025
Summary
CVE-2025-6423 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Themeforest (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_submit_upload_file() function in all versions up to and including 2.3.5. This flaw, tracked as CVE-2025-6423 with a CVSS score of 8.8 and CWE-434, allows unauthenticated file handling that bypasses restrictions on the affected site server.
Authenticated attackers with Subscriber-level access or higher can exploit the issue over the network to upload arbitrary files, which may enable remote code execution on the server. The vulnerability requires low attack complexity and no user interaction, giving the attacker full confidentiality, integrity, and availability impact once successful.
Public references from Wordfence and the Vidmov theme change log on ThemeForest document the vulnerability and are the primary sources for mitigation guidance, though specific patch versions or remediation steps are not detailed in the available data. The EPSS score remains flat at 0.0135 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21207
Vulnerability details
The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_submit_upload_file() function in all versions up to, and including, 2.3.5. This makes it possible for authenticated attackers with Subscriber-level access…
more
or higher to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables T1190 exploitation for initial access, T1505.003 web shell deployment, and T1105 tool/file ingress leading to RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws such as the arbitrary file upload vulnerability in the BeeTeam368 Extensions plugin.
Mandates validation of uploaded file types and contents to directly counter the missing file type validation in the handle_submit_upload_file() function.
Restricts types of allowed inputs, such as prohibiting dangerous file extensions, to block arbitrary file uploads by authenticated users.