CVE-2025-49447CWE-434

WordPress FW Food Menu <= 6.0.0 - Arbitrary File Upload Vulnerability

Critical · published June 17, 2025

CVSS v3.1
10.0
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

🚨 An unrestricted file upload vulnerability in FW Food Menu could leave your system wide open to malicious files! 🔥 Think of it as a restaurant that allows anyone to drop off any ingredient without checking — a rogue chef could slip in spoiled food or even something toxic, putting everyone at risk! An attacker could upload harmful files that enable them to execute arbitrary code on your server, potentially leading to a complete takeover of your system. The consequences could be absolutely devastating — unauthorized access to sensitive data or even a complete service shutdown are just the tip of the iceberg.

Put simply

Think of it as a restaurant that allows anyone to drop off any ingredient without checking — a rogue chef could slip in spoiled food or even something toxic, putting everyone at risk! This vulnerability allows users to upload files of potentially dangerous types without proper validation. As a result, attackers can exploit this flaw to execute malicious code on the server.

What to do

An attacker could upload harmful files that enable them to execute arbitrary code on your server, potentially leading to a complete takeover of your system. The consequences could be absolutely devastating — unauthorized access to sensitive data or even a complete service shutdown are just the tip of the iceberg. Immediately patch your system to version 6.0.1 or later to close this vulnerability. Additionally, implement strict validation checks on file uploads to ensure only safe file types are accepted. Regularly review your security policies to fortify your defenses. You've got this! Follow these steps, secure your site, and keep those digital bad guys at bay! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-06-17T15:01Z
EPSS history
Timeline
  • 17 JUN 15:01Z
    WordPress FW Food Menu <= 6.0.0 - Arbitrary File Upload Vulnerability
    cvelistv5