CVE-2025-5395: WordPress Automatic Plugin RCE Vulnerability

CVE-2025-5395 Overview

CVE-2025-5395 affects the WordPress Automatic Plugin through version 3.115.0. The vulnerability stems from insufficient file type validation in the core.php file. Authenticated attackers with Author-level access or higher can upload arbitrary files to the affected site's server. Successful exploitation can lead to remote code execution on the underlying web server.

The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw impacts a widely deployed commercial WordPress plugin distributed through CodeCanyon.

Critical Impact
Authenticated attackers with Author privileges can upload malicious files and execute arbitrary code on vulnerable WordPress installations running the Automatic Plugin through 3.115.0.

Affected Products

WordPress Automatic Plugin versions up to and including 3.115.0
WordPress installations using the affected plugin via CodeCanyon distribution
Sites granting Author-level or higher access to untrusted users

Discovery Timeline

2025-06-11 - CVE-2025-5395 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5395

Vulnerability Analysis

The WordPress Automatic Plugin automates content posting from external sources into WordPress. The vulnerable core.php file processes file uploads without enforcing strict file type validation. This allows attackers to bypass extension and MIME type checks and place executable PHP files within web-accessible directories.

Once an attacker uploads a malicious file, they can request the file directly through the web server to trigger code execution. Because the WordPress process typically runs PHP scripts in writable upload paths, the uploaded payload executes with the privileges of the web server user. This gives attackers a path from a low-privilege Author account to full server compromise.

The attack requires authentication, but Author-level accounts are common on multi-author publishing sites, membership platforms, and sites accepting guest contributors. Compromised Author credentials, brute-forced accounts, or self-registration workflows can satisfy the precondition.

Root Cause

The root cause is missing or incomplete validation of file content, extension, and MIME type within the plugin's upload handler in core.php. The handler does not enforce an allowlist of safe extensions or verify that uploaded files match declared types before writing them to disk.

Attack Vector

The vulnerability is exploitable over the network through the WordPress administrative interface. An attacker authenticates with an Author-level account and submits a crafted upload request to the plugin's vulnerable endpoint. The malicious file, such as a PHP webshell, is written to a web-accessible directory and then invoked via a follow-up HTTP request to achieve code execution.

No verified public proof-of-concept code is referenced in the advisory. The technical mechanism is described in prose in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5395

Indicators of Compromise

New or unexpected .php, .phtml, or .phar files in wp-content/uploads/ or plugin directories
HTTP POST requests to WordPress Automatic Plugin endpoints from Author-level accounts followed by GET requests to newly created files
WordPress audit log entries showing file uploads with unusual extensions by non-administrator accounts
Outbound network connections initiated by the web server process shortly after suspicious upload activity

Detection Strategies

Inventory all WordPress installations and identify sites running the Automatic Plugin at version 3.115.0 or earlier
Monitor the WordPress uploads directory for files with executable extensions and compare against an established baseline
Inspect web server access logs for sequential upload-then-execute request patterns tied to plugin endpoints
Correlate web shell behavioral indicators such as system, exec, and base64_decode invocations from PHP processes

Monitoring Recommendations

Enable WordPress security plugin logging to capture upload events and user role activity
Forward web server, PHP error, and WordPress audit logs to a central SIEM for correlation
Alert on creation of executable files within wp-content/uploads/ by any non-administrative workflow
Track Author account creation, password resets, and unusual login geolocations as upstream precursors

How to Mitigate CVE-2025-5395

Immediate Actions Required

Update the WordPress Automatic Plugin to the latest release published after version 3.115.0 per the CodeCanyon Plugin Changelog
Audit Author-level and higher accounts and remove or downgrade unused or untrusted users
Scan the uploads directory for unauthorized PHP files and remove confirmed web shells
Rotate credentials for all WordPress users and any database or API keys exposed by the web server

Patch Information

The vendor distributes updates through CodeCanyon. Site operators must download the patched plugin package from their CodeCanyon account and replace the vulnerable files on each affected installation. Confirm the installed version after upgrade through the WordPress admin interface or by inspecting the plugin header.

Workarounds

Restrict execution of PHP within wp-content/uploads/ using web server configuration until patching is complete
Temporarily deactivate the WordPress Automatic Plugin on sites that cannot be updated immediately
Limit Author registrations and disable self-service account creation on affected sites
Place a web application firewall in front of the WordPress installation to filter malicious upload requests

bash

# Apache configuration to block PHP execution in WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9])$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}