PT-2025-21257 · WordPress · 百度站长Seo合集

Youcef Hamdani · Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-3917

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: 百度站长SEO合集 plugin for WordPress versions up to, and including, 2.0.6

Description: The issue is related to arbitrary file uploads due to missing file type validation in the download remote image to media library function. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations: For versions up to, and including, 2.0.6, upgrade to version 2.0.7 to fix the issue. As a temporary workaround, consider disabling the download remote image to media library function until a patch is available. Restrict access to the vulnerable plugin to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-3917

Affected Products

百度站长Seo合集

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-3917 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/70361501-8adc-499a-91d2-cf91fab5934a?source=cve · Note
• https://t.me/cvetracker/23883 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3293597 · Note
• https://wordpress.org/plugins/baiduseo · Note
• https://t.me/latest_high_impact_cve/2371 · Telegram Post
• https://twitter.com/CveFindCom/status/1922865115549806914 · Twitter Post
• https://t.me/cvenotify/122264 · Telegram Post
• https://plugins.trac.wordpress.org/browser/baiduseo/tags/2.0.6/inc/index/youhua.php#L371 · Note