CVE-2025-67924: Corpkit File Upload RCE Vulnerability

CVE-2025-67924 Overview

CVE-2025-67924 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the zozothemes Corpkit WordPress theme. This critical security flaw allows unauthenticated attackers to upload arbitrary files, including malicious web shells, to vulnerable web servers. The vulnerability stems from improper validation of file types during the upload process, enabling complete server compromise through remote code execution.

Critical Impact

Unauthenticated attackers can upload web shells to gain persistent backdoor access to WordPress installations, leading to complete site takeover, data theft, and potential lateral movement within the hosting infrastructure.

Affected Products

• WordPress Corpkit Theme version 2.0 and earlier
• WordPress installations running the Corpkit theme by zozothemes
• All versions from initial release through version 2.0

Discovery Timeline

• 2026-01-08 - CVE-2025-67924 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67924

Vulnerability Analysis

This vulnerability represents a classic unrestricted file upload flaw where the Corpkit WordPress theme fails to properly validate or restrict file types during upload operations. The vulnerability allows attackers to bypass intended security controls and upload executable files such as PHP web shells directly to the web server. Once uploaded, these malicious files can be accessed via HTTP requests to execute arbitrary commands on the underlying server with the privileges of the web server process.

The attack requires no authentication, making it particularly dangerous as any internet-connected attacker can exploit this vulnerability. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2025-67924 lies in the insufficient file upload validation within the Corpkit theme. The application fails to implement proper server-side validation to verify that uploaded files match expected file types. This missing validation allows attackers to circumvent any client-side restrictions and upload dangerous file types including PHP scripts that can execute arbitrary code on the server.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or authentication. An attacker can exploit this flaw by:

1. Identifying a WordPress installation running the vulnerable Corpkit theme (version 2.0 or earlier)
2. Locating the vulnerable file upload endpoint within the theme
3. Crafting a malicious HTTP request containing a PHP web shell disguised or uploaded directly
4. Uploading the malicious file to the server, bypassing any insufficient validation
5. Accessing the uploaded web shell via direct URL to execute commands

The attack complexity is low, as exploitation does not require special conditions or elevated privileges. Once a web shell is deployed, the attacker maintains persistent access to execute arbitrary commands, exfiltrate data, modify content, or pivot to attack other systems on the network.

Detection Methods for CVE-2025-67924

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or theme folders
• Web server access logs showing requests to unusual PHP files outside normal WordPress paths
• File system modifications with timestamps not matching legitimate administrative activity
• Outbound network connections from the web server to unknown external IP addresses
• New or modified .htaccess files in upload or theme directories

Detection Strategies

• Monitor WordPress upload directories (wp-content/uploads/) for newly created PHP, PHTML, or other executable files
• Implement file integrity monitoring to detect unauthorized changes to theme files and directories
• Review web server access logs for POST requests to unusual endpoints followed by GET requests to new PHP files
• Deploy web application firewall (WAF) rules to block upload requests containing PHP content or executable signatures
• Scan for known web shell signatures and patterns in uploaded files using endpoint detection tools

Monitoring Recommendations

• Enable verbose logging on WordPress installations to capture all file upload activities
• Configure alerts for any PHP file creation within upload directories
• Implement real-time file system monitoring on critical WordPress directories
• Review server process execution logs for suspicious child processes spawned by the web server
• Monitor for anomalous network traffic patterns originating from the web server

How to Mitigate CVE-2025-67924

Immediate Actions Required

• Update the Corpkit theme to a patched version if available from zozothemes
• If no patch is available, consider temporarily deactivating the Corpkit theme and switching to a secure alternative
• Audit WordPress installations for any suspicious files that may indicate prior exploitation
• Implement strict file upload restrictions at the web server configuration level
• Review and remove any unauthorized PHP files from upload directories

Patch Information

For detailed patch information and remediation guidance, refer to the Patchstack Vulnerability Report which provides comprehensive details about this vulnerability. WordPress administrators should monitor for theme updates from zozothemes and apply patches immediately when available.

Workarounds

• Restrict file uploads to specific safe extensions (images only) at the web server level
• Implement .htaccess rules to prevent PHP execution in upload directories
• Use a Web Application Firewall (WAF) to filter malicious upload attempts
• Disable or remove the vulnerable file upload functionality if not required
• Consider using a managed WordPress security plugin that provides upload validation and monitoring

# Add to .htaccess in wp-content/uploads/ to prevent PHP execution
<FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>

# Alternative for Apache 2.4+
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>