CVE-2025-49414CWE-434

WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Upload Vulnerability

Critical · published July 4, 2025

CVSS v3.1
10.0
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

🚨 Unrestricted file uploads are a hacker's dream! The FW Gallery plugin for Fastw3b allows anyone to upload dangerous files—like inviting the wolf into your digital sheepfold! 🔥 Think of it like a restaurant that lets customers deliver their own food without checking it first. A crafty patron could sneak in anything from expired meat to hazardous materials, and the unsuspecting chef serves it up without a second thought! This vulnerability is absolutely devastating! An attacker could upload malicious files, potentially leading to remote code execution, data theft, or even a complete takeover of your server. Imagine a digital burglar rummaging through your files, stealing sensitive information, or leaving chaos in their wake!

Put simply

Think of it like a restaurant that lets customers deliver their own food without checking it first. A crafty patron could sneak in anything from expired meat to hazardous materials, and the unsuspecting chef serves it up without a second thought! The unrestricted upload vulnerability in FW Gallery allows attackers to bypass security measures and upload any file type, regardless of the content. This means malicious scripts or executables can make their way onto your server without any validation.

What to do

This vulnerability is absolutely devastating! An attacker could upload malicious files, potentially leading to remote code execution, data theft, or even a complete takeover of your server. Imagine a digital burglar rummaging through your files, stealing sensitive information, or leaving chaos in their wake! Immediate action is crucial! Update FW Gallery to a secure version, as versions from n/a to 8.0.0 are affected. Implement strict file validation to ensure only safe file types are accepted, and consider using server-side checks to block unwanted uploads. 🛡️ You've got this! Follow these steps, and you'll be one step closer to locking down your site against potential threats! 💪✨

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-07-04T11:17Z
EPSS history
Timeline
  • 04 JUL 11:17Z
    WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Upload Vulnerability
    cvelistv5