CVE-2025-31048: 
WordPress vulnerability analysis and mitigation

CVE-2025-31048 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Themify Shopo WordPress theme that allows authenticated attackers to upload web shells to the web server. It affects Shopo versions through 1.1.4, with no official patch available as of the time of reporting. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on March 20, 2025, and published by Patchstack on August 4, 2025; the CVE was formally published on January 5, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the Shopo theme fails to properly validate or restrict the types of files that authenticated users can upload. An attacker with Contributor or Developer-level WordPress privileges can upload arbitrary file types — including PHP web shells — without adequate content-type or extension validation. The attack is network-based, requires low privileges, no user interaction, and has a changed scope, indicating impact can extend beyond the vulnerable component itself. No public proof-of-concept code has been identified, but the vulnerability class is well-understood and commonly exploited in mass-campaign attacks against WordPress sites (Patchstack).

Successful exploitation allows an attacker to upload a PHP web shell or backdoor to the web server, enabling remote code execution (RCE) with the privileges of the web server process. This results in a complete compromise of confidentiality, integrity, and availability of the affected WordPress installation and potentially the underlying server. The changed scope in the CVSS vector indicates that impact can extend to other components or systems hosted on the same server, enabling lateral movement or further infrastructure compromise (Patchstack, Feedly).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, reflecting a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity, and has issued a virtual patch (mitigation rule) to block attacks proactively (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Themify Shopo theme version 1.1.4 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/shopo).
2. Obtain low-privilege credentials: Acquire or register a WordPress account with at least Contributor or Developer role on the target site, either through legitimate registration, credential stuffing, or phishing.
3. Identify the vulnerable upload endpoint: Navigate to the theme's file upload functionality within the WordPress dashboard or identify the relevant AJAX/REST endpoint that handles file uploads without proper validation.
4. Craft malicious payload: Prepare a PHP web shell file (e.g., shell.php) containing code such as <?php system($_GET['cmd']); ?> that enables remote command execution.
5. Upload the web shell: Submit the malicious PHP file through the vulnerable upload mechanism, bypassing any client-side restrictions. The server fails to validate the file type or content, allowing the file to be stored in a web-accessible directory.
6. Execute commands: Access the uploaded web shell via its URL (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands and achieve full server compromise (Patchstack).

• Network: Unusual HTTP POST requests to WordPress upload endpoints (e.g., /wp-admin/admin-ajax.php or theme-specific endpoints) containing PHP file uploads; subsequent GET/POST requests to newly created .php files in /wp-content/uploads/ or theme directories.
• File System: Unexpected .php files in /wp-content/uploads/, /wp-content/themes/shopo/, or other web-accessible directories; files with names like shell.php, cmd.php, c99.php, or random alphanumeric filenames with .php extension.
• Logs: WordPress access logs showing file upload requests followed by direct HTTP access to PHP files in upload directories; web server error logs showing PHP execution from upload paths; entries with encoded or obfuscated query parameters (e.g., ?cmd=, ?c=, ?exec=).
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx spawning bash, curl, wget, python, or nc); outbound network connections from the web server to external IPs.

As of the time of reporting, no official patch has been released by Themify for the Shopo theme. Site administrators should consider removing or deactivating the Shopo theme until a patched version is available. Patchstack has issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts without requiring a code fix. Additional hardening measures include: restricting file upload capabilities to trusted roles only, configuring the web server to deny PHP execution in upload directories (e.g., via .htaccess), implementing a Web Application Firewall (WAF), and monitoring upload directories for unexpected PHP files. Monitor the Patchstack database and Themify's official channels for patch availability (Patchstack).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for August 4–10, 2025, highlighting it as part of a broader set of WordPress theme and plugin vulnerabilities. The Isle of Man Cabinet Office (CSC) issued a vulnerability notice referencing CVE-2025-31048 alongside other notable CVEs. Social media activity on Bluesky and security aggregator sites (VulnDB, CVEFeed, TheHackerWire) noted the critical CVSS score and the absence of an official patch, with some commentary emphasizing the risk to WordPress sites running the Shopo theme (Wordfence, CSC Advisory).