WordPress WP01 Plugin <= 2.6.2 - Arbiträres Herunterladen von Dateien (Path Traversal) Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to bypass intended security restrictions and access files outside of the intended directory. By crafting malicious requests with path traversal sequences (e.g., ../), an attacker can potentially read configuration files, source code, or other sensitive data stored on the server. This could lead to information disclosure, privilege escalation, or even remote code execution if the attacker can leverage the accessed files to compromise the system further. The potential blast radius is significant, as the attacker could gain access to a wide range of files depending on the server's configuration and permissions.

Websites utilizing the WP01 plugin in versions 0.0.0 through 2.6.2 are at risk. This includes sites using shared hosting environments where plugin updates may not be managed automatically, and those with legacy WordPress installations that haven't been regularly updated.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/wp01/*

• generic web:

curl -I 'http://example.com/wp-content/plugins/wp01/../../../../etc/passwd' # Check for file disclosure

1. 2025-03-25Disclosure

   disclosure

1. Reserviert2025-03-24
2. Veröffentlicht2025-03-25
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-30567 is to immediately upgrade the WP01 plugin to version 2.6.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These might include restricting file access permissions on the server to limit the impact of a successful exploit, or using a Web Application Firewall (WAF) to filter out malicious requests containing path traversal sequences. Regularly review and update WordPress security plugins and themes to minimize the attack surface. After upgrading, confirm the fix by attempting a path traversal request and verifying that access is denied.