CVE Intelligence
Analysis AI-assisted

CVE-2018-25335: WordPress Peugeot Music Plugin 1.0 Arbitrary File Upload

CVE-2018-25335 describes an arbitrary file upload flaw in the Peugeot Music WordPress plugin version 1.0, which VulnCheck rates as critical with a CVSS 3.1 base score of 9.8. According to the record, unauthenticated requests can place files with arbitrary extensions in the uploads directory, where they may be executed. CISA KEV does not list this CVE and the sources consulted show no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2018-25335 affects the Peugeot Music plugin for WordPress, version 1.0. The record maps the issue to CWE-306 (Missing Authentication for Critical Function) and lists VulnCheck as the CNA.

Impact

  • The record states that unauthenticated attackers can upload files, which may then be executed from the uploads directory.
  • The CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impact on confidentiality, integrity and availability.
  • VulnCheck also provides a CVSS 4.0 score of 9.3.
  • The SSVC fields in the record report technical impact as total and automatable as yes.

Affected products and versions

  • Product listed: Peugeot-music-plugin Peugeot Music.
  • Version listed: 1.0 only. The consulted record does not list other affected versions.
  • No fixed version is listed in the record.

Exploitation status

  • CISA KEV does not list this CVE, so active exploitation is not confirmed by KEV.
  • The SSVC exploitation field is recorded as none.
  • The reference list includes an Exploit-DB entry tagged as an exploit. This shows a public exploit reference exists in the consulted data, but it does not confirm exploitation in the wild.
  • The EPSS probability is 0.00515 with a percentile of 0.42214.

Remediation and mitigation

  • No vendor fix is listed in the record. The absence of a listed fix does not prove that none exists, so verify with the plugin author or the WordPress plugin repository.
  • If the plugin is installed and no fix can be confirmed, consider deactivating and removing it.
  • Prevent script execution in upload directories at the web server level, and restrict the file types accepted by any upload functionality.
  • Require authentication and authorization checks on upload handlers.
  • If the plugin was exposed, review the site for unexpected files and check its integrity.

Detection guidance

  • Inventory WordPress sites for the Peugeot Music plugin and record the installed version.
  • Review web server logs for unauthenticated requests to the plugin's upload handling and for unexpected responses from it.
  • Monitor upload directories for newly created script files or files with unexpected extensions.
  • Alert when files located in upload paths are requested for execution.

Limitations of the available information

  • The record does not include vendor advisory details, patch information, or a complete list of affected builds.
  • The EPSS date in the record (2026-10-13) is later than the published date (2026-05-17), so the score should be interpreted with care.
  • The technical description is taken from the record and was not independently verified against the plugin code.

Frequently asked questions

Is CVE-2018-25335 known to be actively exploited?

CISA KEV does not list this CVE, and the sources consulted do not confirm exploitation in the wild. The record does reference a public Exploit-DB entry, so organizations should not assume the flaw is unused.

Which versions are affected?

The record lists only version 1.0 of the Peugeot Music plugin for WordPress. No fixed version is listed in the consulted data.

What should administrators do now?

If the plugin is installed, confirm whether a fix exists with the vendor or plugin repository. If not, consider removing it, restrict script execution in upload directories, and add authentication checks to upload handling.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.