PT-2025-17473 · WordPress · The Greenshift

Michael Mazzolini · Published 2025-04-21 · Updated 2025-04-25 · CVE-2025-3616

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Greenshift – animation and page builder blocks plugin for WordPress versions 11.4 through 11.4.5

Description The Greenshift plugin is vulnerable to arbitrary file uploads due to missing file type validation in the gspb make proxy api request() function. This allows authenticated attackers with Subscriber-level access and above to upload arbitrary files on the affected site's server, potentially enabling remote code execution. Over 50,000 WordPress sites are estimated to be at risk. The issue was sufficiently patched in version 11.4.5, and a capability check was added in version 11.4.6 to prevent unauthorized limited file uploads.

Recommendations To resolve the issue for versions 11.4 through 11.4.5, update to version 11.4.6 or later. As a temporary workaround, consider disabling the gspb make proxy api request() function until a patch is available. Restrict access to the vulnerable plugin to minimize the risk of exploitation. Avoid using the affected API endpoints until the issue is resolved.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-3616

Affected Products

The Greenshift

References · 27

• https://osv.dev/vulnerability/CVE-2025-3616 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3276168/greenshift-animation-and-page-builder-blocks/trunk/init.php · Patch
• https://plugins.trac.wordpress.org/changeset/3273212/greenshift-animation-and-page-builder-blocks/trunk/init.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-3616 · Security Note
• https://plugins.trac.wordpress.org/changeset/3270279/greenshift-animation-and-page-builder-blocks/trunk/init.php · Patch
• https://twitter.com/RedTeamNewsBlog/status/1914623385667092677 · Twitter Post
• https://twitter.com/SecAideInfo/status/1915348884890571182 · Twitter Post
• https://twitter.com/modat_magnify/status/1914952988520595483 · Twitter Post
• https://t.me/brutsecurity/1798 · Telegram Post
• https://twitter.com/cybercronai/status/1914726543953142002 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0db4671e-1989-44a4-babe-ed699c7f3a52?source=cve · Note
• https://twitter.com/chux13786509/status/1915682248885518713 · Twitter Post
• https://t.me/cvetracker/22092 · Telegram Post
• https://twitter.com/cracbot/status/1915722528099848201 · Twitter Post
• https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/init.php#L3340 · Note