The vulnerability CVE-2025-58819 affects the Bulk Featured Image plugin by CreedAlly, allowing an authenticated user with high privileges to upload files without proper restrictions on file types. This can be exploited to upload a web shell, granting an attacker remote code execution capabilities on the web server. The issue impacts versions up to and including 1.2.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected web server, including unauthorized access, data theft, data modification, and service disruption. Given the ability to upload a web shell, attackers could execute arbitrary commands remotely, potentially leading to further lateral movement and persistent control over the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Bulk Featured Image plugin to trusted administrators only and monitor for suspicious file uploads. Consider disabling or removing the plugin if not essential. Follow up with CreedAlly for updates on patches or official mitigations.