What is the CVSS score of EUVD-2025-19225?

EUVD-2025-19225 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-19225?

A critical vulnerability in the Reformer for Elementor plugin allows unauthenticated attackers to upload malicious files and execute arbitrary code on affected web servers.

How to fix or mitigate EUVD-2025-19225?

Within 24 hours: Disable the Reformer for Elementor plugin immediately and audit server logs for suspicious file uploads; identify all affected systems and isolate them if breach indicators are present. Within 7 days: Deactivate and remove the plugin entirely, or implement strict WAF rules blocking file uploads to plugin directories; conduct forensic analysis of systems that remained active. Within 30 days: Identify and deploy alternative solutions for Elementor functionality; implement file upload restrictions at the web server and application level; deploy endpoint detection and response (EDR) tools to monitor for post-exploitation activity.

Wordpress Plugin EUVD-2025-19225

| CVE-2025-49444 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-17 audit@patchstack.com

WordPress File Upload Wordpress Plugin

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-19225

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor allows Upload a Web Shell to a Web Server. This issue affects Reformer for Elementor: from n/a through 1.0.5.

AnalysisAI

Critical unrestricted file upload vulnerability in merkulove Reformer for Elementor (versions through 1.0.5) that allows unauthenticated attackers to upload arbitrary files, including web shells, to affected servers. With a perfect CVSS 10.0 score and network-accessible attack vector requiring no privileges or user interaction, this vulnerability enables complete remote code execution and server compromise. Given the prevalence of Elementor in WordPress ecosystems and the trivial exploitation requirements, this represents an immediate and severe threat to all unpatched installations.

Technical ContextAI

The vulnerability resides in the Reformer for Elementor WordPress plugin, a form-building extension for the popular Elementor page builder. The root cause is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating insufficient validation of uploaded file types and content. The plugin's file upload handler fails to implement proper server-side validation, allowing attackers to bypass client-side or weak restrictions and upload executable code (PHP, JSP, ASP, etc.) disguised as legitimate files. This is a classic arbitrary file upload vulnerability that directly enables web shell deployment. Affected versions span from initial release through 1.0.5, suggesting the vulnerability existed since the plugin's inception.

RemediationAI

Immediate actions: (1) Update Reformer for Elementor to version 1.0.6 or later if available—verify patch release on WordPress.org plugin repository or merkulove's official channels; (2) If patch unavailable, immediately disable and deactivate the Reformer for Elementor plugin until patched; (3) If exploitation is suspected (recent file uploads, suspicious PHP files in wp-content/uploads), conduct forensic investigation and remove web shells; (4) Implement Web Application Firewall (WAF) rules to block PHP/executable uploads to wp-content/uploads directory; (5) Apply principle of least privilege—restrict file upload permissions at filesystem level; (6) Monitor for file uploads via logging and behavioral anomaly detection. Long-term: (1) Subscribe to merkulove security advisories; (2) Implement automated plugin update testing and deployment; (3) Consider using security plugins that prevent dangerous file uploads; (4) Audit all uploaded files for executable content.