CVE-2025-54677: Vcita WordPress Plugin RCE Vulnerability

CVE-2025-54677 Overview

CVE-2025-54677 is an arbitrary file upload vulnerability in the vcita Online Booking & Scheduling Calendar plugin for WordPress, distributed as meeting-scheduler-by-vcita. The flaw stems from unrestricted upload of files with dangerous types [CWE-434] and affects all plugin versions up to and including 4.5.3. An authenticated attacker with high privileges can upload malicious files to a target site and achieve full compromise of confidentiality, integrity, and availability. The vulnerability is exploitable over the network without user interaction.

Critical Impact
Successful exploitation allows an attacker to upload executable files such as PHP webshells, leading to remote code execution within the WordPress environment.

Affected Products

vcita Online Booking & Scheduling Calendar for WordPress (meeting-scheduler-by-vcita)
All versions from initial release through 4.5.3
WordPress sites running the affected plugin

Discovery Timeline

2025-08-20 - CVE-2025-54677 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-54677

Vulnerability Analysis

The plugin exposes file upload functionality that fails to validate or restrict the type of files accepted from a request. The handler does not enforce a server-side allowlist of safe MIME types or extensions, nor does it sanitize uploaded filenames against executable content. An attacker authenticated with elevated privileges submits a file with a dangerous extension such as .php, .phtml, or .phar, and the plugin writes it to a web-accessible directory. The file can then be requested directly through the web server, causing the PHP interpreter to execute attacker-controlled code in the context of the web user.

Root Cause

The root cause is missing or insufficient validation in the upload routine, classified under [CWE-434] Unrestricted Upload of File with Dangerous Type. The plugin trusts client-supplied content-type values and does not reconcile file extensions against an allowlist of safe document, image, or calendar formats consistent with the plugin's booking workflow.

Attack Vector

Exploitation requires network access to the WordPress admin surface and an authenticated account with high privileges. After authentication, the attacker invokes the vulnerable upload endpoint with a crafted multipart request containing a server-side script payload. Once written to disk, the attacker browses to the uploaded path to trigger execution. From there, the attacker can install backdoors, pivot to the database, exfiltrate data, or deploy persistence.

No public proof-of-concept has been published. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-54677

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .htaccess files written under wp-content/uploads/ or directories used by the meeting-scheduler-by-vcita plugin.
Outbound connections from the web server process to unknown hosts immediately following an administrative login.
New or modified WordPress administrator accounts created without an authorized change request.
Web server access log entries showing direct GET requests to uploaded files with non-document extensions.

Detection Strategies

Inspect WordPress upload directories for files whose extensions do not match the plugin's expected document or image types.
Correlate admin authentication events with subsequent file write activity from the PHP process to identify abuse of legitimate accounts.
Apply web application firewall rules that block multipart uploads carrying executable extensions or PHP code signatures in the body.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress webroot and plugin directories.
Forward web server, PHP-FPM, and WordPress audit logs to a centralized data lake for retention and correlation.
Alert on any process spawned by the PHP interpreter that executes shell utilities such as sh, bash, wget, or curl.

How to Mitigate CVE-2025-54677

Immediate Actions Required

Update the vcita Online Booking & Scheduling Calendar plugin to a version above 4.5.3 as soon as a fixed release is available from the vendor.
Audit existing administrator and editor accounts and revoke any unused privileged credentials.
Scan the WordPress installation for unauthorized files added since the plugin was installed and remove confirmed webshells.

Patch Information

The vulnerability affects all versions through 4.5.3. Refer to the Patchstack Vulnerability Report for the latest fix status and apply vendor updates as they are released.

Workarounds

Deactivate the meeting-scheduler-by-vcita plugin until a patched version is installed.
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit who can reach the upload endpoint.
Configure the web server to deny execution of PHP files within wp-content/uploads/ and any plugin-specific upload directory.
Enforce multi-factor authentication on all WordPress accounts with upload_files or higher capabilities.

bash

# Example nginx configuration to deny PHP execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php5|php7)$ {
    deny all;
    return 403;
}