CVE-2025-49447: FW Food Menu File Upload Vulnerability

CVE-2025-49447 Overview

CVE-2025-49447 is an Unrestricted Upload of File with Dangerous Type vulnerability discovered in the FW Food Menu WordPress plugin developed by Fastw3b LLC. This vulnerability allows attackers to upload malicious files to vulnerable WordPress installations, potentially leading to complete site compromise. The flaw exists due to insufficient validation of uploaded file types, enabling attackers to upload executable scripts such as PHP web shells.

Critical Impact
This vulnerability allows unauthenticated remote attackers to upload arbitrary malicious files, potentially resulting in complete server compromise, data theft, and website defacement.

Affected Products

FW Food Menu WordPress Plugin versions up to and including 6.0.0
WordPress installations using vulnerable versions of FW Food Menu
Web servers hosting affected WordPress sites

Discovery Timeline

June 17, 2025 - CVE-2025-49447 published to NVD
June 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-49447

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The FW Food Menu plugin fails to properly validate and restrict file types during the upload process. This allows an attacker to bypass intended file type restrictions and upload files with dangerous extensions such as .php, .phtml, or other executable formats.

The attack can be executed remotely over the network without requiring any authentication or user interaction, making it particularly dangerous. Once a malicious file is uploaded, the attacker can access it directly via the web server to execute arbitrary code in the context of the web application, potentially gaining full control over the WordPress installation and underlying server.

Root Cause

The root cause of this vulnerability lies in the plugin's failure to implement proper server-side file type validation. The upload functionality does not adequately verify the MIME type, file extension, or file content before accepting and storing uploaded files. This oversight allows attackers to circumvent any client-side restrictions by manipulating HTTP requests to upload files with dangerous extensions.

Attack Vector

The attack vector is network-based, requiring no authentication or privileges. An attacker can exploit this vulnerability by:

Identifying a WordPress site running a vulnerable version of the FW Food Menu plugin
Crafting a malicious HTTP request containing a PHP web shell or other executable payload
Uploading the malicious file through the vulnerable upload endpoint
Accessing the uploaded file directly via its URL to execute arbitrary commands

The vulnerability enables attackers to establish persistent backdoor access, exfiltrate sensitive data, modify website content, or pivot to attack other systems on the network. Due to the changed scope indicated in the vulnerability metrics, successful exploitation can impact resources beyond the vulnerable component itself.

Detection Methods for CVE-2025-49447

Indicators of Compromise

Unusual PHP files or scripts appearing in WordPress upload directories (e.g., wp-content/uploads/)
Web shell files with suspicious names or obfuscated code in plugin directories
Unexpected outbound network connections from the web server
Modified .htaccess files or new executable files in web-accessible directories

Detection Strategies

Monitor HTTP POST requests to FW Food Menu plugin endpoints for file upload attempts with suspicious file extensions
Implement file integrity monitoring on WordPress directories to detect unauthorized file additions
Review web server access logs for requests to newly created PHP files in upload directories
Deploy web application firewalls (WAF) with rules to block malicious file upload attempts

Monitoring Recommendations

Enable detailed logging for WordPress file upload activities and plugin interactions
Configure alerts for new executable files created in the wp-content directory tree
Monitor for unusual PHP process spawning or command execution patterns
Implement regular security scans of WordPress installations to identify compromised sites

How to Mitigate CVE-2025-49447

Immediate Actions Required

Immediately deactivate and remove the FW Food Menu plugin if running version 6.0.0 or earlier
Audit WordPress upload directories for any suspicious or unexpected files
Review server access logs for signs of exploitation attempts
Consider implementing a web application firewall to block malicious upload attempts

Patch Information

At the time of publication, users should check the Patchstack Vulnerability Advisory for the latest patch information and updated plugin versions from Fastw3b LLC. Organizations should prioritize updating to a patched version as soon as one becomes available.

Workarounds

Disable or remove the FW Food Menu plugin until a security patch is released
Implement server-side file upload restrictions at the web server level to block executable file types
Configure .htaccess rules to prevent PHP execution in upload directories
Use security plugins with file upload protection capabilities to add an additional layer of defense

bash

# Example .htaccess configuration to prevent PHP execution in uploads directory
# Place this file in wp-content/uploads/

<FilesMatch "\.(?i:php|phtml|php3|php4|php5|phps)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Alternative using Apache 2.4+ syntax
<FilesMatch "\.(?i:php|phtml|php3|php4|php5|phps)$">
    Require all denied
</FilesMatch>