CVE-2025-26534
Published: 03 March 2025
Description
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Security Summary
CVE-2025-26534 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the Helloprint WordPress plugin. This issue affects Helloprint versions from n/a through 2.0.7. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity primarily due to its potential for availability disruption.
Unauthenticated remote attackers can exploit this path traversal flaw over the network with low complexity and no user interaction required. By manipulating pathnames, attackers can achieve arbitrary file deletion on the targeted system, resulting in high-impact denial of service as reflected in the CVSS availability metric, with a changed scope affecting broader system components.
Patchstack's advisory documents this as an arbitrary file deletion vulnerability specifically in the WordPress Helloprint plugin version 2.0.7, providing details on the issue in their vulnerability database.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Path traversal in public-facing WordPress plugin enables unauthenticated remote exploitation (T1190) and arbitrary file deletion causing DoS (T1485).