CVE-2025-4413: Pixabay Images Plugin RCE Vulnerability

CVE-2025-4413 Overview

The Pixabay Images plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 3.4. The flaw resides in the pixabay_upload function, which fails to validate file types before writing uploads to the server. Authenticated attackers with Author-level access or higher can abuse this to upload arbitrary files, including executable PHP scripts. Successful exploitation can lead to remote code execution on the underlying host. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with Author privileges can upload arbitrary files and achieve remote code execution on affected WordPress sites.

Affected Products

Pixabay Images plugin for WordPress, versions ≤ 3.4
WordPress installations with the plugin activated
Sites permitting Author-level or higher user registration

Discovery Timeline

2025-06-18 - CVE-2025-4413 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4413

Vulnerability Analysis

The Pixabay Images plugin integrates the Pixabay stock media service into the WordPress media library. The pixabay_upload function handles importing selected images from Pixabay into the site's uploads directory. In versions up to 3.4, this function accepts a user-controlled file reference and writes the retrieved content to disk without verifying the MIME type or file extension against an allowlist of image formats.

Because WordPress executes .php and other server-side files placed within its directory tree, an attacker can weaponize this missing validation. The attacker supplies a URL or filename pointing to a PHP payload, which the plugin fetches and stores under wp-content/uploads/. Requesting the resulting file through the web server triggers code execution in the WordPress process context.

Root Cause

The root cause is a missing file type validation check inside the pixabay_upload function. The plugin trusts the file reference provided by the authenticated user and does not enforce WordPress's wp_check_filetype_and_ext or a hardcoded allowlist of image extensions. This gap allows non-image content to reach the filesystem with attacker-controlled names and extensions. See the WordPress plugin source code for the affected function.

Attack Vector

Exploitation requires an authenticated session with Author-level capabilities or higher. The attacker triggers the plugin's upload endpoint and supplies a file reference resolving to a malicious PHP script. The plugin writes the payload to the uploads directory, after which the attacker issues an HTTP request to the resulting path. The server interprets the file, executing arbitrary code with the privileges of the PHP process. Additional analysis is available in the Wordfence vulnerability report.

Detection Methods for CVE-2025-4413

Indicators of Compromise

Unexpected .php, .phtml, or .phar files inside wp-content/uploads/ directories
Uploads originating from Author-level accounts that do not typically publish media
Web server access logs showing direct GET or POST requests to newly created files under /wp-content/uploads/
Outbound network connections from the PHP worker to unfamiliar hosts following a media upload event

Detection Strategies

Compare file extensions and MIME signatures of files in the uploads directory against an image-only allowlist
Alert on WordPress wp_insert_attachment or plugin-specific hooks writing non-image content
Correlate authentication events for Author-role accounts with subsequent file creation in uploads paths

Monitoring Recommendations

Enable file integrity monitoring across wp-content/uploads/ and plugin directories
Forward WordPress and web server logs to a centralized SIEM for behavioral analysis
Monitor for PHP process executions initiated by requests to files under uploads paths

How to Mitigate CVE-2025-4413

Immediate Actions Required

Deactivate the Pixabay Images plugin until a patched version is confirmed installed
Audit all Author-level and higher accounts and revoke or reset credentials for unknown users
Scan wp-content/uploads/ for executable file types and remove any unauthorized artifacts
Restrict new user registration and enforce multi-factor authentication for privileged roles

Patch Information

At the time of publication, no fixed version beyond 3.4 has been referenced in the CVE record. Administrators should monitor the WordPress plugin repository and the Wordfence advisory for a security release, and update immediately once available.

Workarounds

Remove or disable the Pixabay Images plugin on all affected sites
Configure the web server to deny PHP execution within wp-content/uploads/ using Files or location directives
Enforce least-privilege by demoting non-essential Author accounts to Contributor or Subscriber roles
Deploy a web application firewall rule to block uploads containing PHP tags or non-image MIME types

bash

# Apache: block PHP execution in the uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx: equivalent server block directive
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}