PHP EUVD-2025-18492

CVSS 8.1 (High) with AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible vulnerability requiring no authentication but with high attack complexity (likely dependent on server configuration). The AC:H factor correctly identifies that exploitation requires a specific Apache+mod_php configuration—not all WordPress hosts are vulnerable. However, this configuration is extremely common in shared hosting environments, meaning real-world impact is significant. The CVSS vector appropriately assigns maximum impact ratings (C:H/I:H/A:H) given that RCE allows full system compromise. Without explicit KEV status or EPSS score data provided, the risk assessment relies on attack vector analysis: unauthenticated, network-accessible, public disclosure in plugin ecosystem context, and a widely-adopted affected plugin create substantial real-world risk despite AC:H. This is a genuine priority vulnerability for any WordPress site using this plugin, particularly on standard hosting configurations. Organizations should treat this as critical given the ubiquity of both WordPress and default Apache deployments.

An attacker identifies a WordPress site using the vulnerable Drag and Drop Multiple File Upload for Contact Form 7 plugin (version ≤1.3.8.9). The attacker crafts a malicious .phar file containing PHP code that establishes a web shell (e.g., spawning a reverse shell or persistent backdoor). The attacker submits the contact form with the .phar file attachment, bypassing the plugin's blacklist check because .phar is not in the blocked extensions list. The file is uploaded to the WordPress uploads directory (typically /wp-content/uploads/). The attacker then directly accesses the uploaded .phar file via HTTP (e.g., http://target.com/wp-content/uploads/2025/01/shell.phar). Apache's mod_php interprets the .phar file as PHP code and executes it. The attacker gains remote code execution, allowing them to read/modify database credentials, exfiltrate sensitive data, install persistent backdoors, or pivot to other systems on the network. Attack complexity is rated High because success depends on the server running Apache with mod_php (not NGINX, not PHP-FPM without script handling), but this configuration is widespread in default WordPress hosting, making the vulnerability highly practical despite the AC:H rating.