Unrestricted File Upload Vulnerability in AiBud WP Plugin
CVE-2025-23968
Key Information:
Badges
What is CVE-2025-23968?
The AiBud WP plugin is susceptible to an unrestricted file upload vulnerability, enabling malicious users to upload web shells to the server. This vulnerability is critical as it allows attackers to execute arbitrary commands, leading to full server compromise. Users of AiBud WP versions prior to 1.8.5 should implement immediate security measures to mitigate the risks associated with this flaw. Proper file validation and upload restrictions are essential to safeguard against this type of exploitation, ensuring secure PHP execution and minimizing the potential damage from unauthorized access.
Affected Version(s)
AiBud WP <= 1.8.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved