WordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability

The primary impact of CVE-2025-49060 is the ability for an attacker to upload arbitrary files to the web server. This includes the potential for uploading web shells, which grant the attacker remote code execution capabilities. Successful exploitation could lead to complete server compromise, data theft, modification, or deletion. The attacker could establish a persistent foothold on the system, potentially pivoting to other systems within the network. The ease of file upload, combined with the potential for web shell deployment, makes this a high-risk vulnerability.

WordPress websites utilizing the Wastia component are at risk. Specifically, sites running older versions (0.0.0 – 1.1.3) are vulnerable. Shared hosting environments where users have limited control over plugin installations are particularly susceptible.

• wordpress / composer / npm:

wp plugin list | grep Wastia

• wordpress / composer / npm:

wp plugin update --all

• wordpress / composer / npm:

find /var/www/html/wp-content/plugins/wastia/ -name '*.php' -print0 | xargs -0 grep -i 'allow_url_fopen'

• generic web: Check WordPress plugin directory for Wastia versions prior to 1.1.3.

1. 2025-10-22Disclosure

   disclosure

1. 已保留2025-05-30
2. 发布日期2025-10-22
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-49060 is to immediately upgrade Wastia to version 1.1.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file upload types to only explicitly allowed extensions via WordPress configuration or using a Web Application Firewall (WAF) to block suspicious file uploads. Carefully review existing Wastia installations for any unusual files or processes. After upgrading, confirm the fix by attempting to upload a non-allowed file type and verifying that the upload is rejected.