CVE-2025-47549 WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability

Q: What is CVE-2025-47549?

CVE-2025-47549 is a critical vulnerability in Themefic BEAF, published on 7 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2025-47549 being exploited?

There is no known exploitation of CVE-2025-47549 in the wild and no public exploit code.

Q: How do I fix CVE-2025-47549?

No fix has been published for CVE-2025-47549 yet. Limit exposure of the affected software until one is available.

Critical 9.1 Published 7 May 2025 Updated 28 Apr 2026

Attackers can upload malicious web shells to the server via the BEAF WordPress plugin, leading to remote code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-47549?

CVE-2025-47549 is a critical vulnerability in Themefic BEAF, published on 7 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.

Weakness: CWE-434

Which versions are affected by CVE-2025-47549?

It affects 1 product.

Products include Themefic Ultimate Before After Image Slider \& Gallery.

How do I fix CVE-2025-47549?

No fix has been published for CVE-2025-47549 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-47549 being exploited?

There is no known exploitation of CVE-2025-47549 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-3xgc-7mw7-pvhp.