CVE-2025-3616

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

2.44% chance of exploitation in the next 30 days, 83th percentile

Published

2025-04-22

Proof-of-concept exploits (1)

• b4d-53ct0r/CVE-2025-3616

References

• CVE Record
• NVD entry

Related

• CVE-2025-3613
• CVE-2025-3639
• CVE-2025-3612
• CVE-2025-3649
• CVE-2025-3605
• CVE-2025-3650