CVE-2025-31002: Squeeze File Upload RCE Vulnerability

CVE-2025-31002 Overview

CVE-2025-31002 is an unrestricted file upload vulnerability in the Squeeze WordPress plugin by Bogdan Bendziukov. The flaw affects all versions up to and including 1.6. The plugin fails to validate file types during upload operations, allowing authenticated attackers with high privileges to upload files with dangerous extensions. Successful exploitation enables arbitrary code execution on the underlying web server. The vulnerability is categorized under CWE-434 — Unrestricted Upload of File with Dangerous Type.

Critical Impact

Attackers can upload malicious PHP files to the WordPress server and execute arbitrary code, leading to full site compromise.

Affected Products

• Bogdan Bendziukov Squeeze plugin for WordPress
• All versions from n/a through 1.6
• WordPress installations with the Squeeze plugin active

Discovery Timeline

• 2025-04-09 - CVE-2025-31002 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31002

Vulnerability Analysis

The Squeeze plugin exposes a file upload handler that does not enforce restrictions on uploaded file types. Attackers authenticated with high privileges can submit files containing executable server-side code, such as PHP scripts. Once written to a web-accessible directory, the attacker requests the file via HTTP and the server interprets and executes its contents.

The scope is marked as changed in the CVSS vector, meaning exploitation impacts resources beyond the vulnerable component. Compromise of a single plugin can lead to compromise of the entire WordPress installation, including the database, filesystem, and any other hosted applications sharing the same web server context.

Root Cause

The root cause is missing or insufficient validation of MIME type, file extension, and file content within the plugin's upload routine. The plugin trusts client-supplied metadata and writes the uploaded payload to disk without enforcing a deny-list or allow-list of safe types. WordPress's wp_check_filetype or wp_handle_upload safeguards are either bypassed or not applied to the plugin's custom upload endpoint.

Attack Vector

Exploitation occurs remotely over the network. The attacker must hold a high-privilege account on the target WordPress site. After authenticating, the attacker submits a crafted multipart/form-data request to the plugin's upload endpoint containing a PHP web shell disguised or declared as another file type. The server stores the file in an accessible uploads directory. The attacker then requests the file URL to trigger code execution under the web server account.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for further technical context.

Detection Methods for CVE-2025-31002

Indicators of Compromise

• Unexpected .php, .phtml, .phar, or .htaccess files appearing in wp-content/uploads/ subdirectories
• New administrator accounts or modified user roles created shortly after a file upload event
• Outbound network connections from the web server process to unknown hosts
• Web server access logs showing POST requests to plugin upload endpoints followed by GET requests to newly created files in uploads paths

Detection Strategies

• Audit the WordPress filesystem for executable scripts within media upload directories that should contain only static assets
• Inspect HTTP access logs for sequences indicating upload followed by direct execution of the uploaded resource
• Compare installed plugin versions against the vulnerable range and flag any Squeeze plugin at version 1.6 or earlier
• Monitor PHP process spawns originating from files located under wp-content/uploads/

Monitoring Recommendations

• Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation
• Alert on file creation events in upload directories where the file extension matches server-executable types
• Track authentication events for high-privilege WordPress accounts and correlate with subsequent upload activity

How to Mitigate CVE-2025-31002

Immediate Actions Required

• Disable or remove the Squeeze plugin until a patched version is confirmed available
• Audit all administrator and editor accounts and rotate credentials for any account with upload privileges
• Scan wp-content/uploads/ for unexpected executable files and remove any unauthorized scripts
• Review web server logs for evidence of past exploitation prior to remediation

Patch Information

No fixed version is identified in the published advisory. The vulnerability affects all releases through 1.6. Monitor the Patchstack advisory and the official WordPress plugin repository for updates from the maintainer.

Workarounds

• Deactivate the Squeeze plugin until the maintainer releases a fix that enforces file type validation
• Restrict execution of PHP within wp-content/uploads/ using web server configuration to block code execution from upload directories
• Apply a Web Application Firewall rule to block multipart uploads containing PHP tags or executable file extensions to plugin endpoints
• Limit high-privilege account access to trusted administrators and enforce multi-factor authentication

# Apache: prevent PHP execution within the uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx: add to the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}