CVE-2025-47549
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files, including web shells, to WordPress sites using the BEAF plugin. Attackers can gain full control of affected websites. All WordPress installations with BEAF plugin versions up to 4.6.10 are vulnerable.
💻 Affected Systems
- Themefic BEAF (Before and After Gallery) WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the WordPress site, data theft, defacement, and use as a pivot point for attacking other systems.
Likely Case
Attackers upload web shells to gain persistent access, install malware, steal data, or use the server for malicious activities.
If Mitigated
If file uploads are restricted via web application firewall or server configuration, impact is limited to denial of service or file storage exhaustion.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist. Attack requires no authentication and is trivial to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.11 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'BEAF - Before and After Gallery'. 4. Click 'Update Now' if update is available. 5. If no update appears, manually download version 4.6.11+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable BEAF Plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate beaf-before-and-after-gallery
Restrict File Uploads via .htaccess
linuxBlock PHP file uploads to the BEAF upload directory
Add to .htaccess in wp-content/uploads/beaf-uploads/: <Files *.php> deny from all </Files>
🧯 If You Can't Patch
- Immediately disable the BEAF plugin via WordPress admin or command line
- Implement web application firewall rules to block requests to BEAF upload endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → BEAF version. If version is 4.6.10 or lower, system is vulnerable.Check Version:
wp plugin get beaf-before-and-after-gallery --field=versionVerify Fix Applied:
Confirm BEAF plugin version is 4.6.11 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/beaf-before-and-after-gallery/upload.php with PHP file uploads
- Unusual file creations in wp-content/uploads/beaf-uploads/ directory
Network Indicators:
- POST requests to BEAF upload endpoints with file uploads
- Subsequent requests to newly uploaded PHP files
SIEM Query:
source="web_logs" AND (uri_path="/wp-content/plugins/beaf-before-and-after-gallery/upload.php" OR uri_path CONTAINS "/wp-content/uploads/beaf-uploads/") AND http_method="POST"