What is the CVSS score of EUVD-2025-17476?

EUVD-2025-17476 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17476?

A critical vulnerability in SUMO Affiliates Pro (versions through 10.7.0) allows attackers to upload malicious files without restriction, potentially enabling complete system compromise.

How to fix or mitigate EUVD-2025-17476?

Within 24 hours: Disable the SUMO Affiliates Pro plugin immediately and assess whether malicious files have been uploaded to your systems. Within 7 days: Evaluate alternative affiliate management solutions and implement file upload restrictions at the application level. Within 30 days: Conduct a full security audit of uploaded files, implement application-level file type validation and size restrictions, and establish a process for timely plugin updates.

Wordpress Plugin EUVD-2025-17476

| CVE-2025-32291 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-09 audit@patchstack.com

WordPress File Upload Wordpress Plugin

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17476

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro allows Using Malicious Files. This issue affects SUMO Affiliates Pro: from n/a through 10.7.0.

AnalysisAI

Critical unrestricted file upload vulnerability in FantasticPlugins SUMO Affiliates Pro (versions through 10.7.0) that allows unauthenticated attackers to upload malicious files with dangerous types, leading to complete system compromise. This CWE-434 vulnerability has a perfect CVSS 3.1 score of 10.0 due to network accessibility without authentication or user interaction, and affects all confidentiality, integrity, and availability properties. The vulnerability represents an immediate, easily exploitable threat to any WordPress installation running the affected plugin versions.

Technical ContextAI

This vulnerability stems from improper input validation in the file upload mechanism of the SUMO Affiliates Pro WordPress plugin. CWE-434 (Unrestricted Upload of File with Dangerous Type) occurs when applications accept file uploads without proper verification of file types, extensions, or MIME types, allowing attackers to upload executable code (PHP, shell scripts, etc.) that the web server will process. The SUMO Affiliates Pro plugin, designed for affiliate program management, likely processes file uploads in its affiliate registration, document submission, or media management features without adequate server-side validation. The attack vector is Network (AV:N) with Low complexity (AC:L), no privilege requirements (PR:N), and no user interaction needed (UI:N), meaning the upload endpoint is directly accessible to anonymous users over HTTP/HTTPS. The Scope Change (S:C) indicates the vulnerability can impact resources beyond the vulnerable component, allowing lateral movement or privilege escalation within the WordPress ecosystem.

RemediationAI

Immediate actions: (1) If patch version 10.7.1 or later is available from FantasticPlugins, update immediately via WordPress admin dashboard → Plugins → Update or directly from the vendor repository; (2) If no patch is available, disable and remove SUMO Affiliates Pro until patched ('Plugins' → 'Deactivate' → 'Delete'); (3) Implement temporary mitigation by adding firewall/WAF rules to block requests to known upload endpoints used by the plugin (typically wp-content/plugins/sumo-affiliates-pro/uploads/ or similar); (4) Review file upload directories for suspicious files created since plugin deployment (look for .php, .phtml, .php3, .php4, .php5 files in unexpected locations); (5) Check WordPress admin logs and access logs for upload POST requests from unfamiliar IP addresses. Long-term: monitor FantasticPlugins security advisories and enforce a policy of updating all WordPress plugins within 24-48 hours of patch release for critical vulnerabilities.