PT-2025-19761 · WordPress · External Image Replace Plugin

István Márton · Published 2025-05-05 · Updated 2025-05-06 · CVE-2025-4279

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions External image replace plugin for WordPress versions up to, and including, 1.0.8

Description The issue is related to missing file type validation in the external image replace get posts::replace post function, allowing authenticated attackers with contributor-level and above permissions to upload arbitrary files on the affected site's server. This could potentially lead to remote code execution.

Recommendations For versions up to, and including, 1.0.8, consider disabling the external image replace get posts::replace post function until a patch is available to prevent arbitrary file uploads. Restrict access to file upload functionality for users with contributor-level and above permissions to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-4279

Affected Products

External Image Replace Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-4279 · Security Note
• https://twitter.com/VulmonFeeds/status/1919553553728741712 · Twitter Post
• https://t.me/cvedetector/24479 · Telegram Post
• https://plugins.trac.wordpress.org/browser/external-image-replace/tags/1.0.8/class.php#L87 · Note
• https://twitter.com/CVEnew/status/1919465738441511225 · Twitter Post
• https://twitter.com/CveFindCom/status/1919460657323295207 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ee1624fd-d98b-4953-99dc-a952dda48aa1?source=cve · Note