PT-2025-25710 · Unknown · Merkulove Reformer For Elementor

Phat Rio - Bluerock · Published 2025-06-17 · Updated 2025-06-18 · CVE-2025-49444

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions merkulove Reformer for Elementor versions 1.0.0 through 1.0.5

Description The issue allows an attacker to upload a web shell to a web server, potentially leading to unauthorized access and control. This is due to an Unrestricted Upload of File with Dangerous Type vulnerability.

Recommendations For merkulove Reformer for Elementor versions 1.0.0 through 1.0.5, update to a version later than 1.0.5 to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-49444

Affected Products

Merkulove Reformer For Elementor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-49444 · Security Note
• https://t.me/latest_high_impact_cve/2694 · Telegram Post
• https://twitter.com/CVEnew/status/1934999262506398040 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/reformer-elementor/vulnerability/wordpress-reformer-for-elementor-1-0-5-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/reformer-elementor/vulnerability/wordpress-reformer-for-elementor-1-0-5-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1935369845496766651 · Twitter Post