Security readout for executives and security teams
Plain-English summary
CVE-2018-25335 affects the WordPress Peugeot Music plugin version 1.0. It lets unauthenticated internet users upload arbitrary files through the plugin’s upload endpoint, potentially leading to full website compromise. The issue is critical because no login or user interaction is required. Public exploit information exists, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat as urgent for any internet-facing WordPress site using Peugeot Music 1.0. The business risk is website takeover, data exposure, defacement, or service disruption. Prioritize discovery, removal or vendor-guided remediation, and post-remediation compromise checks.
Technical view
The vulnerability is an unauthenticated arbitrary file upload in Peugeot Music 1.0 for WordPress. Sources state attackers can send POST requests to upload.php and manipulate the file name parameter to upload arbitrary extensions, enabling code execution from the uploads directory. CVSS is 9.8, network exploitable, low complexity, no privileges, no user interaction.
Likely exposure
Exposure is limited to WordPress sites with Peugeot Music plugin version 1.0 installed and reachable from the internet. Sites allowing direct access to the plugin’s upload endpoint are the primary concern. The sources do not identify other affected versions or products.
Exploitation context
A public Exploit-DB entry is cited, indicating exploit details are publicly available. The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. Risk is still high because unauthenticated file upload to code-executable paths is commonly severe.
Researcher notes
The advisory attributes the flaw to missing authentication on file upload functionality, mapped to CWE-306. Evidence supports arbitrary extension upload and potential code execution from uploads. Patch status is not provided in the source bundle, so do not assume a fixed version without vendor confirmation.
Mitigation direction
- Identify WordPress sites running Peugeot Music plugin version 1.0.
- Check vendor or plugin-maintainer guidance for an update or removal recommendation.
- Disable or remove the plugin if no trusted fix is available.
- Restrict public access to the vulnerable upload endpoint where operationally feasible.
- Review uploaded files and web directories for unauthorized executable content.
Validation and detection
- Inventory WordPress plugins and confirm whether Peugeot Music 1.0 is installed.
- Review web server logs for requests to the plugin upload endpoint.
- Inspect uploads directories for unexpected script or executable file types.
- Verify the vulnerable endpoint is no longer publicly reachable after mitigation.
- Confirm any replacement or updated plugin version against vendor guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25335 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-44737CVE reference, VulnCheck · exploit
- VulnCheck Advisory: WordPress Plugin Peugeot Music 1.0 Arbitrary File UploadCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.