CVE-2025-23918: Smallerik File Browser RCE Vulnerability

CVE-2025-23918 Overview

CVE-2025-23918 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the Smallerik File Browser WordPress plugin developed by Enrico Sandoli. This vulnerability allows attackers to upload malicious files, including web shells, to vulnerable WordPress installations, potentially leading to complete server compromise.

Critical Impact

Successful exploitation enables attackers to upload web shells and achieve remote code execution on affected WordPress servers, potentially leading to full site takeover and data breach.

Affected Products

• Smallerik File Browser WordPress plugin version 1.1 and earlier
• WordPress installations with the smallerik-file-browser plugin active

Discovery Timeline

• 2025-01-22 - CVE-2025-23918 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-23918

Vulnerability Analysis

This vulnerability stems from inadequate file upload validation in the Smallerik File Browser plugin. The plugin fails to properly restrict the types of files that can be uploaded through its file browser interface. Without proper validation of file extensions, MIME types, or file content, attackers can bypass intended security controls and upload executable PHP files or other dangerous file types directly to the web server.

The Smallerik File Browser plugin is designed to provide file management capabilities within WordPress. However, the absence of robust file type restrictions creates a critical security gap that attackers can leverage to deploy malicious payloads.

Root Cause

The root cause of CVE-2025-23918 is the failure to implement proper file upload validation mechanisms. Specifically, the plugin does not enforce a whitelist of allowed file extensions, does not validate MIME types against actual file content, and lacks server-side verification to prevent the upload of executable scripts such as PHP web shells.

Attack Vector

An attacker can exploit this vulnerability by accessing the file upload functionality provided by the Smallerik File Browser plugin and uploading a malicious PHP file disguised or crafted as a web shell. Once uploaded, the attacker can access the shell via a direct HTTP request to the uploaded file location, gaining the ability to execute arbitrary commands on the server with the privileges of the web server process.

The attack typically follows this pattern:

1. Attacker identifies a WordPress site with the vulnerable Smallerik File Browser plugin installed
2. Attacker crafts a malicious PHP web shell file
3. Attacker uses the plugin's upload functionality to place the shell on the server
4. Attacker accesses the uploaded shell and executes commands remotely

For technical details on this vulnerability, refer to the Patchstack security advisory.

Detection Methods for CVE-2025-23918

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories, particularly within plugin folders
• Web server access logs showing requests to unfamiliar PHP files in the wp-content/plugins/smallerik-file-browser/ directory
• Unusual outbound network connections originating from the web server process
• Modified file timestamps or new files created in the WordPress installation

Detection Strategies

• Monitor file system changes in WordPress directories for newly created PHP files
• Implement Web Application Firewall (WAF) rules to detect and block web shell upload attempts
• Review web server access logs for suspicious POST requests to the plugin's upload endpoints
• Deploy file integrity monitoring solutions to alert on unauthorized file modifications

Monitoring Recommendations

• Configure real-time alerting for new executable files created in WordPress directories
• Enable detailed logging for file upload operations on the web server
• Monitor for suspicious process execution patterns originating from the web server user account
• Regularly audit installed WordPress plugins against known vulnerability databases

How to Mitigate CVE-2025-23918

Immediate Actions Required

• Deactivate and remove the Smallerik File Browser plugin immediately if no patched version is available
• Audit WordPress file directories for any suspicious or unexpected PHP files
• Review web server access logs for signs of exploitation
• Scan the WordPress installation with security plugins or malware scanners

Patch Information

As of the available information, the vulnerability affects Smallerik File Browser versions through 1.1. Users should check the Patchstack advisory for updates on patched versions. If no patch is available, removing the plugin is strongly recommended.

Workarounds

• Disable the Smallerik File Browser plugin until a security patch is released
• Implement server-level restrictions to prevent PHP execution in upload directories
• Deploy a Web Application Firewall with rules to block malicious file uploads
• Restrict access to the WordPress admin area and plugin functionality using IP whitelisting

# Apache configuration to disable PHP execution in uploads directory
# Add to .htaccess in wp-content/uploads/ or plugin upload directories
<Files *.php>
    deny from all
</Files>

# Nginx configuration equivalent
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}