CVE-2025-3616 Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload

High 8.8 Published 22 Apr 2025 Updated 22 Apr 2025

Authenticated attackers can upload arbitrary files via missing validation, potentially leading to remote code execution on WordPress sites using the Greenshift plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-3616?

CVE-2025-3616 is a high-severity vulnerability in wpsoul Greenshift – animation and page builder blocks, published on 22 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.

Weakness: CWE-434

Which versions are affected by CVE-2025-3616?

It affects 1 product.

Products include Greenshiftwp Greenshift - Animation and Page Builder Blocks.

How do I fix CVE-2025-3616?

No fix has been published for CVE-2025-3616 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-3616 being exploited?

There is no known exploitation of CVE-2025-3616 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-42rf-mpmc-c2vf.