CVE-2025-24775: Forms by Made I.T. RCE Vulnerability

CVE-2025-24775 Overview

CVE-2025-24775 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the Made I.T. Forms WordPress plugin (forms-by-made-it). This vulnerability allows attackers to upload a web shell to a web server, potentially leading to complete site compromise and remote code execution. The vulnerability affects all versions of the Forms plugin through version 2.9.0.

Critical Impact

Attackers can exploit this vulnerability to upload malicious web shells, gaining persistent remote access to the web server and potentially compromising the entire WordPress installation and underlying infrastructure.

Affected Products

• Made I.T. Forms WordPress Plugin versions through <= 2.9.0
• WordPress installations utilizing the forms-by-made-it plugin

Discovery Timeline

• 2025-08-14 - CVE-2025-24775 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-24775

Vulnerability Analysis

This vulnerability stems from inadequate file upload validation within the Made I.T. Forms WordPress plugin. The plugin fails to properly restrict the types of files that can be uploaded through form submissions, allowing attackers to bypass intended security controls and upload executable scripts or web shells directly to the web server.

Web shell upload vulnerabilities are particularly dangerous in WordPress environments because successful exploitation provides attackers with a persistent foothold on the server. Once a web shell is deployed, attackers can execute arbitrary commands, access sensitive configuration files (including database credentials in wp-config.php), modify existing files, create backdoor accounts, and pivot to attack other systems on the network.

Root Cause

The root cause of CVE-2025-24775 is the absence of proper file type validation and sanitization during the file upload process. The Made I.T. Forms plugin does not adequately verify that uploaded files match allowed file types, relying potentially only on client-side validation or easily spoofed MIME type headers rather than implementing robust server-side validation of file content and extensions. This allows attackers to upload files with dangerous extensions such as .php, .phtml, or other executable file types that the web server will interpret and execute.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious file upload request to a form endpoint provided by the vulnerable plugin. The attack typically proceeds as follows:

1. The attacker identifies a WordPress site running the vulnerable Forms plugin version 2.9.0 or earlier
2. The attacker locates a form that permits file uploads
3. A malicious PHP web shell is crafted and uploaded through the form, potentially bypassing any weak client-side restrictions
4. Once uploaded, the attacker accesses the web shell directly via its URL on the server
5. The web shell provides command execution capabilities, allowing the attacker to take control of the server

For detailed technical analysis, see the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-24775

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories, particularly in plugin-specific upload folders
• Newly created files with suspicious names or encoded content in /wp-content/uploads/ or plugin directories
• Web server access logs showing requests to unusual PHP files in upload directories
• Outbound network connections originating from the web server to unknown external hosts

Detection Strategies

• Monitor WordPress upload directories for newly created executable files (.php, .phtml, .php5, etc.)
• Implement file integrity monitoring on the WordPress installation to detect unauthorized file additions
• Review web server access logs for POST requests to form endpoints followed by direct access to new files in upload directories
• Deploy web application firewall (WAF) rules to detect and block common web shell signatures in file uploads

Monitoring Recommendations

• Configure real-time alerting for any new PHP file creation in WordPress upload directories
• Enable and regularly review WordPress audit logs for file upload activities
• Monitor for unusual process spawning from the web server process (e.g., www-data spawning shell commands)
• Implement network monitoring to detect command and control traffic patterns from the web server

How to Mitigate CVE-2025-24775

Immediate Actions Required

• Update the Made I.T. Forms plugin to a patched version immediately if available
• If no patch is available, deactivate and remove the forms-by-made-it plugin until a fix is released
• Audit all existing uploaded files for potential web shells or malicious content
• Implement server-level restrictions to prevent PHP execution in upload directories

Patch Information

Consult the Patchstack WordPress Vulnerability Report for the latest patch availability and update instructions. Ensure you are running a version newer than 2.9.0 once a security update is released.

Workarounds

• Disable file upload functionality in all forms created with the Made I.T. Forms plugin
• Add server configuration to disable PHP execution in upload directories
• Implement a web application firewall (WAF) to block uploads of potentially dangerous file types
• Use .htaccess rules (Apache) or nginx configuration to prevent script execution in upload directories

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Place this file in /wp-content/uploads/.htaccess

# Disable PHP execution
<Files *.php>
    deny from all
</Files>

# Alternative: Disable all script handlers
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|cgi|pl|asp|aspx|shtml|shtm|htaccess|htpasswd|ini|log|sh|bash)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>