CVE-2025-64374: 
WordPress vulnerability analysis and mitigation

CVE-2025-64374 is a critical Unrestricted File Upload vulnerability (CWE-434) in the Motors WordPress theme by StylemixThemes, allowing authenticated attackers to upload and execute malicious files. It affects all versions of the Motors theme up to and including 5.6.81. The vulnerability was published on December 18, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 9.9 (Critical) (Feedly, Patchstack).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the Motors theme fails to properly validate or restrict the file types that authenticated users can upload. An attacker with low-privilege credentials (e.g., a subscriber or contributor account) can upload a file with a dangerous type — such as a PHP web shell — through the theme's file upload functionality. Because the scope is marked as Changed in the CVSS vector, successful exploitation can impact resources beyond the vulnerable component itself, such as the underlying web server and other hosted sites. No specific technical write-up or PoC code has been publicly released at this time (Feedly, Patchstack).

Successful exploitation grants an attacker the ability to upload and execute arbitrary code on the web server, resulting in full compromise of confidentiality, integrity, and availability. An attacker could deploy a web shell to gain persistent remote access, exfiltrate sensitive data (including WordPress database credentials), deface the site, or use the compromised server as a pivot point for lateral movement within the hosting environment. With approximately 20,000 active installations of the Motors theme, the potential attack surface is significant (Patchstack, Infosecurity Magazine).

1. Reconnaissance: Identify WordPress sites using the Motors theme (versions ≤ 5.6.81) via tools like WPScan, Shodan, or by inspecting page source for theme indicators.
2. Obtain low-privilege credentials: Register or obtain a low-privilege WordPress account (e.g., subscriber role) on the target site, or use previously compromised credentials.
3. Locate the vulnerable upload endpoint: Navigate to the theme's file upload functionality within the WordPress dashboard or identify the relevant AJAX/REST API endpoint that handles file uploads without proper type validation.
4. Craft malicious upload request: Prepare a PHP web shell file (e.g., shell.php) and submit it via the vulnerable upload mechanism, bypassing any client-side restrictions.
5. Execute the web shell: Access the uploaded file via its public URL on the server (e.g., https://target.com/wp-content/uploads/shell.php) to achieve remote code execution and establish persistent access (Patchstack, Infosecurity Magazine).

• File System: Unexpected PHP files (e.g., shell.php, cmd.php) in WordPress upload directories such as wp-content/uploads/ or theme-specific subdirectories; newly created files with unusual names or extensions in web-accessible directories.
• Logs: Web server access logs showing POST requests to WordPress upload endpoints (e.g., /wp-admin/admin-ajax.php) followed by GET requests to newly created PHP files in upload directories; requests from unusual IP addresses to theme-specific upload handlers.
• Network: Outbound connections from the web server process to unknown external IPs or C2 infrastructure; unusual DNS lookups originating from the web server.
• Process: Unexpected child processes spawned by the web server (e.g., Apache/Nginx/PHP-FPM) such as bash, curl, wget, or python; unusual cron jobs added under the web server user account.

StylemixThemes has released a patched version of the Motors theme; users should update to version 5.6.82 or later immediately. Site administrators who cannot update immediately should consider temporarily disabling the Motors theme or restricting file upload capabilities via a Web Application Firewall (WAF) rule. Additionally, limiting WordPress user registrations and reviewing existing user accounts for unauthorized low-privilege accounts is recommended as a precautionary measure (Patchstack, Infosecurity Magazine).

Patchstack published a dedicated article highlighting the critical severity of this vulnerability and its potential impact on approximately 20,000 WordPress sites using the Motors theme, emphasizing the risk of complete site takeover (Patchstack). Infosecurity Magazine covered the story, noting the site takeover risk posed by the flaw (Infosecurity Magazine). The vulnerability was also included in The Hacker News weekly security recap, indicating broader industry awareness (The Hacker News).