CVE-2025-13094: 
WordPress vulnerability analysis and mitigation

CVE-2025-13094 is an arbitrary file upload vulnerability in the WP3D Model Import Viewer plugin for WordPress, caused by missing file type validation in the handle_import_file() function. It affects all plugin versions up to and including 1.0.7, and was published on December 13, 2025. Authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially enabling remote code execution. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type): the handle_import_file() function in the WP3D Model Import Viewer plugin performs no validation of the uploaded file's type or extension, allowing any file — including PHP web shells — to be written to the server. The attack vector is network-based, requires low privileges (Author-level WordPress account), no user interaction, and has low attack complexity. An attacker who has obtained or registered an Author-level account can directly invoke the import functionality to place a malicious file in a web-accessible directory (Wordfence, ENISA EUVD). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an authenticated attacker to upload and potentially execute arbitrary server-side code, leading to full compromise of the WordPress site. This encompasses high impact to confidentiality (access to sensitive data and credentials), integrity (modification or defacement of site content and files), and availability (disruption or destruction of site functionality). A compromised server could also serve as a pivot point for lateral movement within the hosting environment (Wordfence, Red Hat).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.264%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the WP3D Model Import Viewer plugin (version ≤ 1.0.7) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain Author-level access: Register or compromise a WordPress account with at least Author-level privileges (e.g., via credential stuffing, phishing, or exploiting open registration).
3. Craft malicious file: Prepare a PHP web shell (e.g., shell.php containing <?php system($_GET['cmd']); ?>) disguised or directly named as a PHP file.
4. Invoke the import function: Authenticate to the WordPress dashboard and use the WP3D Model Import Viewer plugin's import feature, submitting the malicious file via the handle_import_file() function — no file type restriction will block the upload.
5. Locate the uploaded file: Determine the upload destination path (typically within the WordPress uploads directory or plugin-specific folder) by reviewing server responses or directory listings.
6. Execute remote code: Access the uploaded PHP file via its web-accessible URL (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to achieve remote code execution on the server (Wordfence).

• File System: Unexpected PHP files (e.g., .php, .phtml, .php5) in WordPress upload directories (/wp-content/uploads/) or plugin directories; newly created files with web shell signatures (system(), exec(), passthru(), eval()).
• Logs: WordPress or web server access logs showing POST requests to plugin import endpoints followed by GET requests to newly created PHP files in upload directories; unusual file creation timestamps in plugin or upload folders.
• Network: Outbound connections from the web server process to unknown external IPs shortly after a file upload event; HTTP responses from unexpected PHP files in the uploads directory.
• Process: Unusual child processes spawned by the web server (e.g., Apache/Nginx/PHP-FPM) such as bash, curl, wget, or python executing system commands.

Administrators should update the WP3D Model Import Viewer plugin to a version beyond 1.0.7 that addresses this vulnerability, as the patch involves adding proper file type validation to the handle_import_file() function (Wordfence). If an update is not immediately available, restrict WordPress user roles to limit Author-level account creation and review existing accounts. Additional mitigations include deploying a Web Application Firewall (WAF) to block malicious file upload attempts, configuring the server to deny execution of scripts in upload directories, and monitoring server logs for suspicious upload activity.

Wordfence disclosed and assigned this CVE, publishing it in their weekly WordPress vulnerability report for December 8–14, 2025 (Wordfence Weekly Report). The vulnerability was also referenced in a CISA vulnerability bulletin (CISA Bulletin) and noted by security aggregators such as RedPacket Security on social media. Community reaction has been routine for a plugin-level WordPress vulnerability of this severity, with no exceptional controversy or widespread alarm observed.