CVE-2024-25913 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). 🔍 **Flaw**: The plugin fails to validate file types/extensions during upload. ⚠️ **Root**: Dangerous file types are not restricted.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Skymoonlabs. 📦 **Product**: MoveTo (WordPress Plugin). 📅 **Affected**: Version **6.2** and earlier versions.

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: Unauthenticated access required. 📂 **Data**: Can upload arbitrary files. 💻 **Action**: Execute code on the server via uploaded scripts.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. 🔓 **Auth**: No authentication needed (Unauthenticated). 🌐 **Network**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L).

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: No specific PoC code provided in data. 🌍 **Wild Exp**: Likely easy to exploit due to low barrier. 🔗 **Ref**: Patchstack advisory available.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for Moveto plugin version ≤ 6.2. 📂 **Feature**: Look for file upload endpoints. 🧪 **Test**: Attempt to upload non-image files (e.g., .php).

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update to version **> 6.2**. 📢 **Source**: Vendor patch available via Patchstack. ✅ **Status**: Official fix exists.

Q: What if no patch? (Workaround)

🚫 **Workaround**: Disable the plugin if not used. 🛡️ **WAF**: Block upload requests with dangerous extensions. 🔒 **Perms**: Restrict upload directory execution permissions.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. 📊 **CVSS**: 9.8 (High). ⏳ **Urgency**: Patch immediately. ⚠️ **Risk**: Unauthenticated remote code execution.

Updated May 08, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Unrestricted file upload in WordPress Plugin Moveto. <br>💥 **Consequences**: Attackers can upload malicious files (e.g., webshells).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). <br>🔍 **Flaw**: The plugin fails to validate file types/extensions during upload. <br>⚠️ **Root**: Dangerous file types are not restricted.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Skymoonlabs. <br>📦 **Product**: MoveTo (WordPress Plugin). <br>📅 **Affected**: Version **6.2** and earlier versions.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Unauthenticated access required. <br>📂 **Data**: Can upload arbitrary files. <br>💻 **Action**: Execute code on the server via uploaded scripts.

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. <br>🔓 **Auth**: No authentication needed (Unauthenticated). <br>🌐 **Network**: Network accessible (AV:N). <br>🎯 **Complexity**: Low (AC:L).

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: No specific PoC code provided in data. <br>🌍 **Wild Exp**: Likely easy to exploit due to low barrier. <br>🔗 **Ref**: Patchstack advisory available.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for Moveto plugin version ≤ 6.2. <br>📂 **Feature**: Look for file upload endpoints. <br>🧪 **Test**: Attempt to upload non-image files (e.g., .php).

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update to version **> 6.2**. <br>📢 **Source**: Vendor patch available via Patchstack. <br>✅ **Status**: Official fix exists.

Q9What if no patch? (Workaround)

🚫 **Workaround**: Disable the plugin if not used. <br>🛡️ **WAF**: Block upload requests with dangerous extensions. <br>🔒 **Perms**: Restrict upload directory execution permissions.

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. <br>📊 **CVSS**: 9.8 (High). <br>⏳ **Urgency**: Patch immediately. <br>⚠️ **Risk**: Unauthenticated remote code execution.

Continue exploring

Vulnerability detail Full AI analysis (login) Skymoonlabs CWE-434