CVE-2025-3616: Greenshift WordPress Plugin RCE Vulnerability

CVE-2025-3616 Overview

CVE-2025-3616 affects the Greenshift animation and page builder blocks plugin for WordPress. The vulnerability allows arbitrary file uploads through the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution on the host. The flaw is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The arbitrary file upload was patched in version 11.4.5, and an additional capability check was added in 11.4.6 to block unauthorized limited file uploads.

Critical Impact
Subscriber-level attackers can upload arbitrary files to vulnerable WordPress sites, enabling potential remote code execution and full site compromise.

Affected Products

Greenshift – animation and page builder blocks plugin for WordPress, versions 11.4 through 11.4.5
WordPress sites with Subscriber-level (or higher) registration enabled and the vulnerable plugin installed
All hosting environments running the affected init.php proxy API request handler

Discovery Timeline

2025-04-22 - CVE-2025-3616 published to NVD
2025-05-28 - Last updated in NVD database

Technical Details for CVE-2025-3616

Vulnerability Analysis

The vulnerability resides in the gspb_make_proxy_api_request() function within init.php of the Greenshift plugin. The function accepts file upload operations from authenticated users without validating the MIME type or extension of the submitted file. An attacker authenticated as a Subscriber, the lowest privilege role in a standard WordPress installation, can invoke the proxy API endpoint and write attacker-controlled files into the WordPress filesystem. Because the plugin runs in the WordPress PHP context, an uploaded PHP file placed within the web root becomes executable when accessed over HTTP, yielding remote code execution on the host.

Root Cause

The root cause is missing file type validation combined with an incomplete authorization check in gspb_make_proxy_api_request(). The handler accepts arbitrary file content and writes it to disk without verifying that the uploaded file matches an allowlist of permitted types. The function also fails to verify that the calling user holds an appropriate capability such as upload_files. Version 11.4.5 addressed the file type validation issue, and version 11.4.6 added the missing capability check to prevent low-privilege users from invoking the upload path. Reference the WordPress Plugin Code Review for the original vulnerable code path.

Attack Vector

The attack is performed over the network against the WordPress site's REST or AJAX endpoint registered by the plugin. The attacker first obtains Subscriber credentials, either through self-registration on sites that allow it or by compromising an existing low-privilege account. The attacker then sends a crafted HTTP request to the proxy API endpoint with a malicious PHP payload as the file body. Once the file is written into the uploads directory, the attacker requests its URL to trigger execution. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-3616

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing in the WordPress wp-content/uploads/ directory or plugin asset directories
HTTP POST requests to Greenshift proxy API endpoints originating from Subscriber-level accounts shortly after account creation
Outbound connections from the web server to attacker infrastructure following a successful upload request
New or modified administrator accounts created without authorized administrative activity

Detection Strategies

Inspect WordPress access logs for POST requests referencing gspb_make_proxy_api_request or admin-ajax actions tied to the Greenshift plugin
Hash and inventory files within the WordPress uploads tree, alerting on files with executable PHP extensions
Monitor user registration events followed by immediate file upload activity from the same session
Correlate web server process spawns of sh, bash, or cmd originating from PHP worker processes

Monitoring Recommendations

Enable WordPress audit logging for plugin actions, file changes, and role modifications
Forward web access logs and PHP error logs to a centralized analytics platform for retention and correlation
Run integrity monitoring on the document root with alerts on new executable script files
Track the Greenshift plugin version across the estate and flag any installation still running 11.4.0 through 11.4.5

How to Mitigate CVE-2025-3616

Immediate Actions Required

Update the Greenshift plugin to version 11.4.6 or later on every WordPress instance where it is installed
Audit the wp-content/uploads/ directory for unauthorized PHP files and remove any not associated with legitimate uploads
Review WordPress user accounts and revoke Subscriber accounts created during the exposure window
Rotate WordPress administrator passwords and secret keys defined in wp-config.php if compromise is suspected

Patch Information

The vendor released fixes across three changesets. Version 11.4.5 added file type validation as documented in WordPress Changeset #3270279 and WordPress Changeset #3273212. Version 11.4.6 added the missing capability check, as shown in WordPress Changeset #3276168. Administrators should upgrade directly to 11.4.6 or later to receive both fixes.

Workarounds

Disable the Greenshift plugin until version 11.4.6 or later can be applied
Disable open user registration in WordPress settings to remove the primary path to Subscriber-level access
Configure the web server to deny execution of PHP files within the wp-content/uploads/ directory
Restrict access to wp-admin/admin-ajax.php for unauthenticated and Subscriber-level users via a web application firewall rule

bash

# Apache: block PHP execution inside the uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx equivalent: add to the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}