CVE-2025-11724: EM Beer Manager WordPress RCE Flaw

CVE-2025-11724 Overview

CVE-2025-11724 is an arbitrary file upload vulnerability in the EM Beer Manager plugin for WordPress affecting all versions up to and including 3.2.3. The flaw resides in the EMBM_Admin_Untappd_Import_image() function, which lacks file type validation, combined with missing authorization checks on the wp_ajax_embm-untappd-import AJAX action. Authenticated attackers holding subscriber-level access or higher can upload arbitrary files, including PHP files, and achieve remote code execution on the server. Exploitation requires the attacker to control or provide a mock HTTP server that returns crafted JSON data consumed by the import routine. This issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated subscribers can upload PHP files and execute arbitrary code on the underlying WordPress host, leading to full site compromise.

Affected Products

EM Beer Manager plugin for WordPress, all versions up to and including 3.2.3
WordPress sites where any user role at subscriber level or above can authenticate
Web servers hosting vulnerable plugin installations with PHP execution enabled in upload paths

Discovery Timeline

2025-11-04 - CVE-2025-11724 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11724

Vulnerability Analysis

The EM Beer Manager plugin integrates with the Untappd service to import beer data and associated images. During the import workflow, the plugin fetches an image URL provided in a JSON response and writes the retrieved content to the WordPress uploads directory. The EMBM_Admin_Untappd_Import_image() function does not validate the MIME type, file extension, or content of the downloaded resource before persisting it. The wp_ajax_embm-untappd-import action handler is registered without a capability check, so any authenticated user, including a subscriber, can invoke it.

An attacker who controls a remote HTTP endpoint can return JSON that points the import routine to an attacker-supplied PHP payload. The plugin saves the payload into a web-accessible directory using its remote filename, enabling direct execution through an HTTP request. Successful exploitation grants code execution under the privileges of the PHP worker process, exposing the database, secrets in wp-config.php, and the wider host.

Root Cause

The root cause is twofold: missing file type validation in the image import helper and a broken access control gap on the AJAX action. Together they violate the secure design principle of restricting privileged file-write operations to authorized administrators and validated content types.

Attack Vector

Exploitation is network-based and requires a valid low-privilege account. The attacker stands up an HTTP server returning crafted JSON, authenticates to WordPress, and issues a request to the wp_ajax_embm-untappd-import endpoint pointing at the attacker-controlled server. See the Wordfence Vulnerability Report and the vulnerable Untappd integration source for the affected code paths.

Detection Methods for CVE-2025-11724

Indicators of Compromise

Files with .php, .phtml, or other executable extensions present in the WordPress uploads directory, particularly under paths used by the EM Beer Manager plugin
Outbound HTTP requests from the WordPress host to unexpected external endpoints initiated during invocations of admin-ajax.php?action=embm-untappd-import
POST requests to admin-ajax.php with the action=embm-untappd-import parameter originating from subscriber or low-privilege accounts
New or unexpected administrative accounts, scheduled tasks, or modifications to PHP files in wp-content following plugin activity

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php containing embm-untappd-import and correlate with the originating user role
Monitor file integrity on the wp-content/uploads tree and alert on creation of files with PHP-executable extensions
Use WordPress audit logging to flag image import actions performed by non-administrator users

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized analytics platform and alert on AJAX actions referencing the vulnerable handler
Track outbound network connections from PHP worker processes to non-allowlisted destinations
Review newly registered subscriber accounts on sites exposing open registration

How to Mitigate CVE-2025-11724

Immediate Actions Required

Disable or uninstall the EM Beer Manager plugin on any WordPress site running version 3.2.3 or earlier until a fixed release is applied
Audit user accounts and remove unused subscriber-level accounts, and disable open registration where it is not required
Scan the wp-content/uploads directory for unexpected PHP files and remove any unauthorized artifacts
Rotate WordPress secrets, database credentials, and API keys if evidence of exploitation is found

Patch Information

No fixed version is referenced in the available advisories at the time of NVD publication. Monitor the WordPress plugin repository and the Wordfence advisory for an updated release beyond 3.2.3 and apply it immediately when available.

Workarounds

Block PHP execution within the WordPress uploads directory using web server configuration
Restrict access to admin-ajax.php actions associated with the plugin via a web application firewall rule targeting action=embm-untappd-import
Limit outbound HTTP requests from the WordPress host to known, allowlisted destinations to prevent retrieval of attacker-hosted payloads

bash

# Apache: deny PHP execution inside the WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (server block):
# location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
#     deny all;
#     return 403;
# }