CVE-2025-3616
HIGHGreenshift Animation and Page Builder Blocks 11.4-11.4.5 - Authenticated Arbitrary File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-3616. PoCs published by b4d-53ct0r.
AI-analyzed exploit summary This is a Metasploit module for CVE-2025-3616, an arbitrary file upload vulnerability in the Greenshift WordPress plugin (versions 11.4 through 11.4.5). It allows authenticated users (Subscriber+) to bypass MIME type validation by spoofing GIF magic bytes, leading to RCE.
Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
Exploits (1)
This is a Metasploit module for CVE-2025-3616, an arbitrary file upload vulnerability in the Greenshift WordPress plugin (versions 11.4 through 11.4.5). It allows authenticated users (Subscriber+) to bypass MIME type validation by spoofing GIF magic bytes, leading to RCE.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H