CVE-2018-25436 -- CVSS 9.8 Vulnerability Briefing

CVE-2018-25436 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2018-25436 is an unrestricted file upload vulnerability affecting the Baggage Freight Shipping Australia WordPress plugin version 0.1.0, exploitable by unauthenticated remote attackers through the plugin's file upload functionality.

Technical Detail

The plugin fails to enforce authentication or file type restrictions on its upload endpoint, allowing any unauthenticated attacker to submit arbitrary files directly to the server. By uploading a malicious PHP script or web shell, an attacker can achieve remote code execution (RCE) in the context of the web server process. Successful exploitation grants the attacker the ability to execute arbitrary commands, read sensitive files, pivot within the hosting environment, or establish persistent access.

Exploitation Status

No known exploit code has been publicly documented for this vulnerability, and it is not listed in the CISA Known Exploited Vulnerabilities catalog as of June 22, 2026. While the vulnerability class (unauthenticated arbitrary file upload leading to RCE) is well understood and trivially exploitable in principle, no confirmed in-the-wild exploitation or public proof-of-concept has been recorded at this time.

Who Is Targeting This

No specific threat actor attribution at this time. No confirmed or reported threat actors have been associated with exploitation of this vulnerability in available intelligence sources.

What To Do

Given the plugin's age and low adoption profile, the most effective remediation is to remove the Baggage Freight Shipping Australia plugin entirely if it is not actively required, as no patched version beyond 0.1.0 has been confirmed available. If removal is not immediately possible, restrict access to the plugin's upload endpoint at the web server or WAF layer by blocking unauthenticated POST requests to the relevant upload path. Operators should audit their WordPress installations for the presence of this plugin and inspect upload directories for any previously deposited web shells or unexpected PHP files. Given the critical CVSS score of 9.8 and the unauthenticated attack vector, treat remediation as high priority even in the absence of confirmed active exploitation.