What is the CVSS score of EUVD-2025-18639?

EUVD-2025-18639 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of PHP are affected by EUVD-2025-18639?

The Pixabay Images WordPress plugin contains a critical file upload vulnerability affecting all versions up to 3.4 that could allow authorized internal users (Authors and above) to upload malicious…

How to fix or mitigate EUVD-2025-18639?

Within 24 hours: Audit all user accounts with Author-level or higher privileges and review recent file uploads in the plugin directory. Within 7 days: Implement Web Application Firewall (WAF) rules to block suspicious file uploads to the plugin's upload endpoint, and disable the Pixabay plugin if not actively used. Within 30 days: Monitor for vendor patch release and prepare for immediate deployment once available; consider migrating to alternative image sourcing solutions if the plugin remains unpatched.

PHP EUVD-2025-18639

| CVE-2025-4413 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-18 security@wordfence.com

WordPress RCE PHP Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:49 euvd

EUVD-2025-18639

Analysis Generated

Mar 14, 2026 - 22:49 vuln.today

CVE Published

Jun 18, 2025 - 03:15 nvd

HIGH 8.8

DescriptionCVE.org

The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

The Pixabay Images plugin for WordPress versions up to 3.4 contains an arbitrary file upload vulnerability in the pixabay_upload function due to missing file type validation. Authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially enabling remote code execution. This vulnerability has a CVSS score of 8.8 (High) and represents a significant risk to WordPress installations using this plugin.

Technical ContextAI

The vulnerability exists in the pixabay_upload function within the Pixabay Images WordPress plugin. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating the application fails to properly validate and restrict file types during upload operations. WordPress plugins execute with the privileges of the WordPress application itself, meaning uploaded executable files (PHP, etc.) would execute with web server privileges. The plugin integrates with Pixabay's image API but fails to enforce file type restrictions on user-supplied uploads, allowing bypass of WordPress's standard security mechanisms. The vulnerability requires authentication (Author-level minimum), placing it within the authenticated attacker threat model common in WordPress supply-chain and insider threats.

RemediationAI

Immediate actions: (1) Update Pixabay Images plugin to version 3.5 or later immediately via WordPress admin dashboard Plugins > Updates, or manually download from wordpress.org plugin repository. (2) If update is unavailable, deactivate and remove the Pixabay Images plugin entirely. (3) Restrict Author-level user creation and audit existing Author accounts for suspicious file uploads. (4) Review wp-content/uploads directory for unexpected or executable files (*.php, *.phtml, *.php3, etc.). (5) Implement file type restrictions at web server level (deny PHP execution in uploads directory via .htaccess or web server configuration). (6) Conduct WordPress audit to identify any webshells or backdoors planted via this vulnerability. (7) Review access logs for suspicious uploads correlating with Author-level account activity. Contact plugin author/check wordpress.org/plugins/pixabay-images for official patch advisory and timeline.