CVE-2025-28951: Bulk Featured Image RCE Vulnerability

CVE-2025-28951 Overview

CVE-2025-28951 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the CreedAlly Bulk Featured Image WordPress plugin. This vulnerability allows attackers to upload malicious files, including web shells, to the target web server. The flaw exists in the plugin's file upload functionality, which fails to properly validate file types before accepting uploads, enabling remote attackers to execute arbitrary code on vulnerable WordPress installations.

Critical Impact

Successful exploitation allows attackers to upload web shells, gaining persistent remote access to the web server with the ability to execute arbitrary commands, steal sensitive data, and pivot to other systems on the network.

Affected Products

• CreedAlly Bulk Featured Image plugin version 1.2.4 and earlier
• WordPress installations using the bulk-featured-image plugin
• All versions from initial release through version 1.2.4

Discovery Timeline

• 2025-07-04 - CVE-2025-28951 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2025-28951

Vulnerability Analysis

This vulnerability stems from improper file upload validation within the Bulk Featured Image WordPress plugin. The plugin provides functionality to bulk set featured images for WordPress posts and pages, but the upload handling mechanism lacks sufficient security controls. Specifically, the plugin does not adequately restrict the types of files that can be uploaded, allowing attackers to bypass intended restrictions and upload executable files such as PHP web shells.

When exploited, an attacker can upload a malicious PHP file disguised as an image or directly as a PHP script. Once uploaded to the web server, the attacker can access this file through a direct HTTP request, triggering execution of the malicious code. This provides the attacker with a persistent backdoor into the WordPress installation and underlying server infrastructure.

Root Cause

The root cause of this vulnerability is the absence of proper file type validation and sanitization in the plugin's upload handler. The plugin fails to implement multiple layers of file validation, including:

• Extension whitelist verification
• MIME type validation
• File content inspection
• Filename sanitization

Without these security controls, the upload function accepts any file type, regardless of whether it poses a security risk. This is a common weakness in WordPress plugins where developers focus on functionality without implementing secure file handling practices.

Attack Vector

The attack vector involves an authenticated or unauthenticated attacker (depending on plugin configuration) submitting a crafted HTTP request containing a malicious file to the vulnerable upload endpoint. The attacker crafts a request with a PHP web shell payload, potentially with a double extension (e.g., shell.php.jpg) or directly as a .php file if no extension checking is performed.

Once the malicious file is stored on the server, the attacker can navigate to the uploaded file's location (typically within the WordPress uploads directory structure) and execute arbitrary PHP code. This enables full server compromise, including database access, file system manipulation, and lateral movement within the network.

Detection Methods for CVE-2025-28951

Indicators of Compromise

• Presence of unexpected PHP files in WordPress upload directories (wp-content/uploads/)
• Web shell files with suspicious names or double extensions (e.g., .php.jpg, .phtml)
• Unusual outbound network connections originating from the web server
• Unexpected process execution under the web server user context
• Modified timestamps on WordPress core files or creation of new files in plugin directories

Detection Strategies

• Monitor file system changes in WordPress upload directories for new PHP or executable files
• Implement web application firewall (WAF) rules to detect file upload exploitation attempts
• Review web server access logs for requests to unusual file paths within upload directories
• Deploy file integrity monitoring on WordPress installations to detect unauthorized file additions
• Analyze server processes for unexpected command execution patterns

Monitoring Recommendations

• Enable detailed logging for all file upload operations in WordPress
• Configure alerts for new file creation events in web-accessible directories
• Implement endpoint detection and response (EDR) monitoring on web servers
• Establish baseline behavior patterns for WordPress file system activity
• Monitor for DNS queries to known command and control infrastructure from web servers

How to Mitigate CVE-2025-28951

Immediate Actions Required

• Disable or remove the Bulk Featured Image plugin (bulk-featured-image) immediately if version 1.2.4 or earlier is installed
• Audit WordPress upload directories for suspicious PHP files or web shells
• Review web server access logs for evidence of exploitation attempts
• Implement network segmentation to limit impact if compromise has occurred
• Update WordPress core and all plugins to their latest versions

Patch Information

Organizations should check the Patchstack WordPress Vulnerability database for the latest patch information and remediation guidance from the vendor. If no patched version is available, the plugin should be removed entirely from the WordPress installation.

Workarounds

• Remove the Bulk Featured Image plugin from all WordPress installations until a patched version is released
• Implement server-level file upload restrictions to block PHP file uploads in the uploads directory
• Configure .htaccess rules to prevent PHP execution in WordPress upload directories
• Deploy a web application firewall with rules to block malicious file upload attempts
• Use WordPress security plugins to restrict file types that can be uploaded

# Add to .htaccess in wp-content/uploads/ to prevent PHP execution
<FilesMatch "\.(?:php|phtml|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Alternative Apache configuration
<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
</Directory>