CVE-2025-10049: WordPress Portfolio Plugin RCE Vulnerability

CVE-2025-10049 Overview

CVE-2025-10049 is an arbitrary file upload vulnerability in the Responsive Filterable Portfolio plugin for WordPress. The flaw affects all versions up to and including 1.0.24. Authenticated attackers with Administrator-level access or above can upload arbitrary files through the HdnMediaSelection_image field. The plugin fails to validate file types before storing uploads on the server. Successful exploitation may lead to remote code execution on the affected WordPress site. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated administrator can upload PHP or other executable files and achieve remote code execution on the WordPress server.

Affected Products

Responsive Filterable Portfolio plugin for WordPress, versions up to and including 1.0.24
WordPress sites running the vulnerable plugin with administrator accounts
Fixed in Responsive Filterable Portfolio version 1.0.25

Discovery Timeline

2025-09-10 - CVE-2025-10049 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10049

Vulnerability Analysis

The Responsive Filterable Portfolio plugin accepts file uploads via the HdnMediaSelection_image form field without enforcing server-side file type validation. The plugin does not verify file extensions, MIME types, or magic bytes before writing the uploaded content to disk. An authenticated attacker with administrator privileges can submit a request containing a PHP file disguised as an image, or any other executable script supported by the web server. Once written to a web-accessible directory, the attacker requests the file directly through HTTP and the web server executes its contents. This grants the attacker arbitrary code execution under the privileges of the WordPress process.

Root Cause

The root cause is missing input validation on uploaded files, mapped to CWE-434. The plugin trusts client-supplied data in the HdnMediaSelection_image field and writes it to the filesystem without enforcing an allowlist of permitted extensions or content types. Patch details are available in the WordPress Plugin Changeset.

Attack Vector

Exploitation requires an authenticated session with Administrator role or higher. The attacker submits a crafted POST request to the plugin endpoint that handles media selection, supplying a malicious file payload through the HdnMediaSelection_image parameter. After the file is stored, the attacker invokes it through a direct URL to trigger execution. The vulnerability is reachable over the network with low attack complexity. Refer to the Wordfence Vulnerability Report for additional technical context. No verified public proof-of-concept exploit code is available at the time of writing.

Detection Methods for CVE-2025-10049

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar in the plugin's upload directories under wp-content/
POST requests to plugin endpoints containing the HdnMediaSelection_image parameter with non-image payloads
Outbound network connections initiated from the web server process shortly after an administrator upload event
New or modified WordPress administrator accounts followed by file upload activity

Detection Strategies

Inspect web server access logs for POST requests referencing the Responsive Filterable Portfolio plugin paths combined with suspicious file extensions in the response or filesystem
Monitor the WordPress uploads directory for newly created files whose extensions do not match the declared image type
Hash and compare plugin files against the official 1.0.25 release to detect tampering or webshell drops

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/uploads/ and plugin directories
Alert on PHP process execution originating from upload directories that should only contain static media
Forward WordPress and web server logs to a centralized SIEM for correlation of administrator actions with file write events

How to Mitigate CVE-2025-10049

Immediate Actions Required

Update the Responsive Filterable Portfolio plugin to version 1.0.25 or later on all WordPress installations
Audit administrator accounts and remove any unrecognized or stale privileged users
Rotate credentials for all administrator-level accounts and enforce multi-factor authentication
Scan the WordPress filesystem for unauthorized PHP files in upload directories

Patch Information

The vendor released a fix in version 1.0.25 of the Responsive Filterable Portfolio plugin. Review the code change in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Deactivate and remove the Responsive Filterable Portfolio plugin until patching is possible
Restrict administrator access to trusted IP addresses through web application firewall rules
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level handler restrictions

bash

# Apache configuration example to block PHP execution in WordPress uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]?)$">
        Require all denied
    </FilesMatch>
</Directory>

# Update the plugin via WP-CLI
wp plugin update responsive-filterable-portfolio --version=1.0.25