CVE-2025-47549: Themefic BEAF Gallery RCE Vulnerability

CVE-2025-47549 Overview

CVE-2025-47549 is an unrestricted file upload vulnerability in the Themefic BEAF (Before and After Gallery) WordPress plugin, also marketed as Ultimate Before After Image Slider & Gallery. The flaw affects all versions up to and including 4.6.10 and is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. An authenticated attacker with high privileges can upload a web shell to the WordPress server and achieve arbitrary code execution. Successful exploitation compromises confidentiality, integrity, and availability of the underlying host.

Critical Impact
Authenticated attackers can upload web shells to vulnerable WordPress sites, leading to full server compromise and persistent remote code execution.

Affected Products

Themefic BEAF (beaf-before-and-after-gallery) WordPress plugin
Themefic Ultimate Before After Image Slider & Gallery
All versions from n/a through 4.6.10

Discovery Timeline

2025-05-07 - CVE-2025-47549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47549

Vulnerability Analysis

The BEAF plugin exposes a file upload handler that fails to validate or restrict the file types accepted from authenticated users. Because the handler does not enforce an allow-list of safe extensions or verify MIME types and file contents, an attacker can submit PHP files disguised or named to execute under the web server. Once written to a web-accessible directory, the uploaded file functions as a web shell that the attacker can invoke through HTTP requests.

The vulnerability requires authentication with elevated privileges, which limits remote anonymous exploitation but does not eliminate risk. Compromised administrator accounts, credential stuffing against WordPress logins, and insider threats all provide viable paths to abuse the upload endpoint. The EPSS score is 0.443%.

Root Cause

The root cause is missing or insufficient server-side validation in the plugin's file upload routine. The handler does not enforce an extension allow-list, does not verify file content against expected image types, and does not strip executable interpreters such as .php, .phtml, or .phar. WordPress's default upload directory is web-accessible, so any executable file written there can be reached directly through a browser request.

Attack Vector

An attacker authenticates to a WordPress site running BEAF <= 4.6.10 with sufficient privileges to invoke the plugin's upload functionality. The attacker submits a crafted multipart request containing a PHP web shell to the vulnerable endpoint. After the file is stored in the WordPress uploads directory, the attacker requests the file directly to execute arbitrary code under the web server user. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-47549

Indicators of Compromise

Files with executable extensions such as .php, .phtml, .phar, or .html written under wp-content/uploads/ or BEAF-specific upload paths
Outbound HTTP requests or reverse shell traffic originating from the PHP-FPM or web server process
New or modified administrator accounts created shortly after BEAF upload activity
POST requests to BEAF AJAX or REST endpoints followed by GET requests to newly created files in the uploads directory

Detection Strategies

Monitor WordPress access logs for sequential upload-then-execute request patterns targeting wp-content/uploads/
Hash and baseline plugin directories and uploads folders; alert on the appearance of executable file types in media paths
Inspect web application firewall logs for multipart POST requests containing PHP tags such as <?php in file bodies
Correlate authenticated session activity with file creation events under web-accessible directories

Monitoring Recommendations

Enable WordPress audit logging to capture plugin upload actions and tie them to user identities
Deploy file integrity monitoring on wp-content/ to detect unauthorized writes
Forward web server, PHP-FPM, and WordPress logs to a centralized analytics platform for correlation
Alert on PHP process execution spawning shell interpreters such as /bin/sh, bash, or nc

How to Mitigate CVE-2025-47549

Immediate Actions Required

Update the Themefic BEAF plugin to a version newer than 4.6.10 once the vendor publishes a fixed release
Audit administrator and editor accounts; rotate credentials and enforce multi-factor authentication
Scan wp-content/uploads/ for unauthorized PHP files and remove any web shells
Review WordPress and web server logs for prior exploitation activity dating back to plugin installation

Patch Information

At the time of publication, refer to the Patchstack Vulnerability Report for the latest patch status. Apply vendor updates as soon as a fixed version is released and verify the installed version through the WordPress plugin manager.

Workarounds

Deactivate and remove the BEAF plugin until a patched version is available
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directives such as php_flag engine off or equivalent nginx location rules
Restrict access to the WordPress admin interface by IP allow-list or VPN to reduce exposure of authenticated endpoints
Deploy a web application firewall rule that blocks multipart uploads containing PHP code signatures

bash

# Apache: deny PHP execution in WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}