CVE-2025-23918: Smallerik File Browser RCE Vulnerability

CVE-2025-23918 Overview

CVE-2025-23918 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the Smallerik File Browser WordPress plugin developed by Enrico Sandoli. This vulnerability allows attackers to upload malicious files, including web shells, to vulnerable WordPress installations, potentially leading to complete server compromise.

Critical Impact
Successful exploitation enables attackers to upload web shells and achieve remote code execution on affected WordPress servers, potentially leading to full site takeover and data breach.

Affected Products

Smallerik File Browser WordPress plugin version 1.1 and earlier
WordPress installations with the smallerik-file-browser plugin active

Discovery Timeline

2025-01-22 - CVE-2025-23918 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-23918

Vulnerability Analysis

This vulnerability stems from inadequate file upload validation in the Smallerik File Browser plugin. The plugin fails to properly restrict the types of files that can be uploaded through its file browser interface. Without proper validation of file extensions, MIME types, or file content, attackers can bypass intended security controls and upload executable PHP files or other dangerous file types directly to the web server.

The Smallerik File Browser plugin is designed to provide file management capabilities within WordPress. However, the absence of robust file type restrictions creates a critical security gap that attackers can leverage to deploy malicious payloads.

Root Cause

The root cause of CVE-2025-23918 is the failure to implement proper file upload validation mechanisms. Specifically, the plugin does not enforce a whitelist of allowed file extensions, does not validate MIME types against actual file content, and lacks server-side verification to prevent the upload of executable scripts such as PHP web shells.

Attack Vector

An attacker can exploit this vulnerability by accessing the file upload functionality provided by the Smallerik File Browser plugin and uploading a malicious PHP file disguised or crafted as a web shell. Once uploaded, the attacker can access the shell via a direct HTTP request to the uploaded file location, gaining the ability to execute arbitrary commands on the server with the privileges of the web server process.

The attack typically follows this pattern:

Attacker identifies a WordPress site with the vulnerable Smallerik File Browser plugin installed
Attacker crafts a malicious PHP web shell file
Attacker uses the plugin's upload functionality to place the shell on the server
Attacker accesses the uploaded shell and executes commands remotely

For technical details on this vulnerability, refer to the Patchstack security advisory.

Detection Methods for CVE-2025-23918

Indicators of Compromise

Unexpected PHP files appearing in WordPress upload directories, particularly within plugin folders
Web server access logs showing requests to unfamiliar PHP files in the wp-content/plugins/smallerik-file-browser/ directory
Unusual outbound network connections originating from the web server process
Modified file timestamps or new files created in the WordPress installation

Detection Strategies

Monitor file system changes in WordPress directories for newly created PHP files
Implement Web Application Firewall (WAF) rules to detect and block web shell upload attempts
Review web server access logs for suspicious POST requests to the plugin's upload endpoints
Deploy file integrity monitoring solutions to alert on unauthorized file modifications

Monitoring Recommendations

Configure real-time alerting for new executable files created in WordPress directories
Enable detailed logging for file upload operations on the web server
Monitor for suspicious process execution patterns originating from the web server user account
Regularly audit installed WordPress plugins against known vulnerability databases

How to Mitigate CVE-2025-23918

Immediate Actions Required

Deactivate and remove the Smallerik File Browser plugin immediately if no patched version is available
Audit WordPress file directories for any suspicious or unexpected PHP files
Review web server access logs for signs of exploitation
Scan the WordPress installation with security plugins or malware scanners

Patch Information

As of the available information, the vulnerability affects Smallerik File Browser versions through 1.1. Users should check the Patchstack advisory for updates on patched versions. If no patch is available, removing the plugin is strongly recommended.

Workarounds

Disable the Smallerik File Browser plugin until a security patch is released
Implement server-level restrictions to prevent PHP execution in upload directories
Deploy a Web Application Firewall with rules to block malicious file uploads
Restrict access to the WordPress admin area and plugin functionality using IP whitelisting

bash

# Apache configuration to disable PHP execution in uploads directory
# Add to .htaccess in wp-content/uploads/ or plugin upload directories
<Files *.php>
    deny from all
</Files>

# Nginx configuration equivalent
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}