CVE-2025-25130
Published: 03 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-25130 is a Relative Path Traversal vulnerability (CWE-23) in the WordPress plugin Delete Comments By Status, developed by Shah Alom. This issue affects the plugin from unknown initial versions through version 2.1.1.
The vulnerability can be exploited by an unauthenticated attacker over the network (AV:N), though it requires high attack complexity (AC:H) and user interaction (UI:R), with no privileges required (PR:N) and unchanged scope (S:U). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS 3.1 base score of 7.5, enabling path traversal to potentially access or manipulate files outside intended directories.
Patchstack has documented this vulnerability in its database, providing details via the advisory at https://patchstack.com/database/Wordpress/Plugin/delete-comments-by-status/vulnerability/wordpress-external-video-for-everybody-plugin-2-1-1-cross-site-scripting-xss-vulnerability-3?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a remote unauthenticated path traversal in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for initial access and file manipulation outside intended directories.