#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Mitigates CVE-2025-10647 by deactivating/quarantining the 'Embed PDF for # WPForms' plugin, blocking PHP execution in uploads/, and optionally # quarantining suspicious executable files found under uploads/. # # DESCRIPTION # Actions (idempotent): # 1) Deactivate plugin via WP-CLI if present; otherwise rename folder. # 2) Quarantine plugin directory by renaming to *.disabled. # 3) Add/ensure .htaccess rules in uploads/ to deny PHP execution. # 4) Optional: move PHP-like files from uploads/ to wp-content/quarantine. # VARIABLES TO DEFINE: # # None required. Arguments control behavior: # # $1 = WordPress root (required) # # $2 = --quarantine-uploads (optional) # WARNINGS: # # Disables plugin functionality. Requires write access to WP paths and .htaccess. # # EXECUTION # chmod +x ./mitigate_cve_2025_10647.sh && ./mitigate_cve_2025_10647.sh /var/www/html --quarantine-uploads # # Or: # # bash ./mitigate_cve_2025_10647.sh /var/www/html # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== set -u WP_ROOT="${1:-}" QUARANTINE_UPLOADS="${2:-}" if [[ -z "$WP_ROOT" ]]; then echo "ERROR: Provide WordPress root path as first argument." >&2 exit 2 fi WP_ROOT="$(cd "$WP_ROOT" 2>/dev/null && pwd || true)" if [[ -z "$WP_ROOT" || ! -d "$WP_ROOT/wp-content" ]]; then echo "ERROR: Invalid WordPress root: $WP_ROOT" >&2 exit 2 fi PLUGIN_SLUG="embed-pdf-for-wpforms" PLUGIN_DIR="$WP_ROOT/wp-content/plugins" PLUGIN_PATH="$PLUGIN_DIR/$PLUGIN_SLUG" QUAR_DIR="$WP_ROOT/wp-content/quarantine" UPLOADS_DIR="$WP_ROOT/wp-content/uploads" HTACCESS="$UPLOADS_DIR/.htaccess" mkdir -p "$QUAR_DIR" || true if command -v wp >/dev/null 2>&1; then (cd "$WP_ROOT" && wp plugin deactivate "$PLUGIN_SLUG" >/dev/null 2>&1) || true fi if [[ -d "$PLUGIN_PATH" && ! -d "${PLUGIN_PATH}.disabled" ]]; then mv "$PLUGIN_PATH" "${PLUGIN_PATH}.disabled" 2>/dev/null || true fi if [[ -d "$UPLOADS_DIR" ]]; then if [[ -f "$HTACCESS" ]]; then if ! grep -q "Require all denied" "$HTACCESS" 2>/dev/null; then cat >>"$HTACCESS" <<'EOF' # --- Security hardening: block PHP execution in uploads (CVE-2025-10647) Require all denied AddType text/plain .php .phtml .php5 .phar # --- EOF fi else cat >"$HTACCESS" <<'EOF' # --- Security hardening: block PHP execution in uploads (CVE-2025-10647) Require all denied AddType text/plain .php .phtml .php5 .phar # --- EOF fi fi if [[ "${QUARANTINE_UPLOADS:-}" == "--quarantine-uploads" && -d "$UPLOADS_DIR" ]]; then mapfile -t exec_hits < <(find "$UPLOADS_DIR" -type f -iregex '.*\.$php\|phtml\|php[0-9]\|phar$$' -printf '%p\n' 2>/dev/null || true) ts="$(date +%Y%m%d%H%M%S)" for f in "${exec_hits[@]}"; do mv "$f" "$QUAR_DIR/$(basename "$f").$ts.quar" 2>/dev/null || true done fi echo "Mitigation complete. Update plugin when a fixed version is released and rotate salts/sessions." exit 0

Description