CVE-2025-13376: ProjectList WordPress Plugin RCE Vulnerability

CVE-2025-13376 Overview

The ProjectList plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions through 0.3.0. The flaw exists in the pl-add.php page, where the plugin fails to validate file types during upload operations. Authenticated attackers with Editor-level access or higher can upload arbitrary files, including PHP scripts, to the affected site. This weakness is classified as Unrestricted Upload of File with Dangerous Type [CWE-434] and can lead to remote code execution on the underlying server.

Critical Impact
Successful exploitation grants attackers code execution under the web server context, enabling full site compromise, data theft, and lateral movement.

Affected Products

WordPress ProjectList plugin versions 0.1.0 through 0.3.0
WordPress installations with Editor role users that include the ProjectList plugin
Multisite WordPress deployments where the plugin is network-activated

Discovery Timeline

2025-11-25 - CVE-2025-13376 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13376

Vulnerability Analysis

The ProjectList plugin exposes a file upload routine in pages/pl-add.php that does not enforce file extension or MIME type checks. Authenticated users with Editor capabilities can submit a multipart form containing executable PHP content. The server writes the file into a web-accessible directory under the WordPress uploads path. Subsequent HTTP requests to the uploaded file invoke the PHP interpreter and execute attacker-controlled code.

Exploitation requires high privileges, since only Editor-level accounts or above can reach the vulnerable handler. However, Editor roles are commonly delegated to content contributors and external staff, broadening the realistic attack surface. The vulnerability affects confidentiality, integrity, and availability because code execution under the web server user can read database credentials in wp-config.php, modify site content, and pivot to other services.

Root Cause

The root cause is missing server-side file type validation in the upload routine referenced at line 27 of pl-add.php. The plugin trusts the supplied filename and content without restricting executable extensions such as .php, .phtml, or .phar. WordPress core provides wp_check_filetype_and_ext() and wp_handle_upload() helpers for safe uploads, but the plugin bypasses these mechanisms.

Attack Vector

An authenticated Editor sends a POST request to the plugin's add-project endpoint with a crafted file payload. The request body includes a PHP webshell renamed with an executable extension. The plugin stores the file inside the uploads directory and returns the resulting URL. The attacker then issues a GET request to that URL, triggering PHP execution. Reference details are available in the WordPress Plugin Source Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13376

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .pht files in wp-content/uploads/ directories created by Editor accounts
HTTP POST requests to pl-add.php containing multipart form data with executable file extensions
New outbound connections or reverse shells originating from the PHP-FPM or web server process
WordPress audit log entries showing Editor users adding projects immediately followed by uploads directory writes

Detection Strategies

Inspect web server access logs for requests to the ProjectList plugin endpoint paired with subsequent direct requests to files in wp-content/uploads/
Hash and inventory all files under wp-content/uploads/ and alert on PHP-executable extensions
Correlate WordPress user activity logs with file system modification events to identify Editor-driven uploads
Use file integrity monitoring to detect new script files written outside expected media directories

Monitoring Recommendations

Enable verbose WordPress logging for plugin activity and user role actions
Forward Apache or NGINX access logs to a centralized log analytics platform for query-based hunting
Monitor process creation events on the web server host for PHP child processes spawning shells (sh, bash, nc)
Track outbound network connections from web server processes to non-standard ports or unknown destinations

How to Mitigate CVE-2025-13376

Immediate Actions Required

Deactivate and remove the ProjectList plugin from any WordPress site running version 0.3.0 or earlier until a patched release is available
Audit all Editor-level and Administrator accounts and rotate credentials for any that may have been used to access the plugin
Scan wp-content/uploads/ for unauthorized PHP files and remove confirmed webshells
Restrict PHP execution within the uploads directory using web server configuration rules

Patch Information

No fixed version is referenced in the published advisory at the time of disclosure. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for an updated release that introduces server-side file type validation.

Workarounds

Block direct execution of PHP files inside wp-content/uploads/ through Apache .htaccess or NGINX location directives
Restrict the Editor role's plugin capabilities using a role management plugin until a patch is released
Deploy a web application firewall rule that blocks multipart uploads with PHP extensions targeting the plugin endpoint
Apply principle of least privilege by demoting non-essential Editor accounts to Author or Contributor roles

bash

# NGINX configuration to block PHP execution in WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|pht)$ {
    deny all;
    return 403;
}