Urgent: ProjectList WordPress Plugin Vulnerable to Arbitrary File Uploads (CVE-2025-13376)

Overview

A critical security vulnerability, identified as CVE-2025-13376, has been discovered in the ProjectList WordPress plugin. This vulnerability allows authenticated attackers with Editor-level access or higher to upload arbitrary files to the affected WordPress site’s server. This could lead to remote code execution and complete compromise of the website.

Technical Details

The vulnerability stems from a lack of proper file type validation in the ProjectList plugin. Specifically, the pl-add.php page is vulnerable. Versions up to and including 0.3.0 are affected. The plugin fails to adequately check the file extension and content type of uploaded files, allowing malicious actors to bypass security measures. Authenticated users with the Editor role (or higher) can leverage this flaw to upload malicious files, such as PHP scripts, directly to the server.

Affected Code Snippets (see references):

• ProjectList v0.3.0 – pl-add.php
• ProjectList (Trunk) – pl-add.php

CVSS Analysis

This vulnerability has been assigned a CVSS score of 7.2, indicating a HIGH severity. The CVSS vector string is likely something similar to: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H) – Editor level access
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality Impact (C): High (H)
• Integrity Impact (I): High (H)
• Availability Impact (A): High (H)

Possible Impact

Successful exploitation of this vulnerability could have severe consequences:

• Remote Code Execution (RCE): Attackers can execute arbitrary code on the server, gaining complete control of the website.
• Data Breach: Sensitive data stored on the server could be accessed and stolen.
• Website Defacement: The website can be defaced or used for malicious purposes, such as phishing or malware distribution.
• Denial of Service (DoS): Attackers could potentially crash the server, rendering the website unavailable to legitimate users.

Mitigation and Patch Steps

1. Update Immediately: If an updated version of the ProjectList plugin is available, update to the latest version immediately. This is the most effective way to address the vulnerability. Check the WordPress plugin repository for an update.
2. Disable the Plugin: If an update is not yet available or if you are no longer using the plugin, disable and uninstall it immediately to prevent potential exploitation.
3. Web Application Firewall (WAF): Implement a Web Application Firewall (WAF) with rules to detect and block arbitrary file upload attempts. Wordfence and other reputable security plugins often include WAF functionality.
4. Monitor for Suspicious Activity: Regularly monitor your website’s logs for any suspicious file uploads or other unusual activity.
5. Principle of Least Privilege: Restrict user roles and permissions to the minimum necessary. Only grant Editor-level access to trusted users.