WordPress DigiWidgets Image Editor plugin <= 1.10 - Vulnerabilidade de Execução de Código Remoto (RCE)

The impact of this RCE vulnerability is severe. An attacker can leverage Remote Code Inclusion to execute malicious code directly on the server hosting the DigiWidgets Image Editor. This could involve deploying malware, stealing sensitive data, modifying website content, or establishing a persistent backdoor for future access. The blast radius extends to the entire server and potentially any connected systems if the attacker gains further access. Successful exploitation could be akin to a complete system compromise, allowing for data exfiltration and further malicious activities.

WordPress websites utilizing the DigiWidgets Image Editor plugin are at risk. Specifically, sites running older versions (0.0.0 - 1.10) are vulnerable. Shared hosting environments where users have limited control over plugin installations are particularly susceptible.

• wordpress / composer / npm:

grep -r 'kellydiek DigiWidgets Image Editor' /var/www/html/
wp plugin list | grep digiwidgets-image-editor

• generic web:

curl -I https://your-website.com/wp-content/plugins/digiwidgets-image-editor/ | grep -i 'digiwidgets-image-editor'

1. 2025-04-01Disclosure

   disclosure

1. Reservado2025-03-24
2. Publicada2025-04-01
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-30580 is to immediately upgrade DigiWidgets Image Editor to version 1.10.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting file upload permissions within the WordPress environment to prevent the upload of malicious code. Review and harden WordPress security configurations, including disabling unnecessary plugins and themes. Monitor server logs for suspicious activity related to file uploads or code execution.