WordPress Database Toolset Plugin <= 1.8.4 - Arbiträres Löschen von Dateien Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to bypass intended security restrictions and read files outside of the intended directory. A successful exploit could lead to the exposure of sensitive data such as configuration files, database credentials, or even source code. Depending on the files accessible, this could enable further compromise of the system, including privilege escalation or data exfiltration. The impact is amplified if the server hosts critical data or is part of a larger network, as the attacker could potentially use this vulnerability as a stepping stone for lateral movement.

WordPress websites utilizing the neoslab Database Toolset plugin, particularly those with shared hosting environments or legacy configurations, are at risk. Sites where the Database Toolset is used to manage sensitive data, such as database credentials or API keys, are especially vulnerable.

• wordpress / composer / npm:

grep -r '../' /var/www/html/wp-content/plugins/database-toolset/*

• generic web:

curl -I 'http://your-website.com/database-toolset/../../../../etc/passwd' # Check for file disclosure

1. 2025-04-11Disclosure

   disclosure

1. Reserviert2025-04-09
2. Veröffentlicht2025-04-11
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade Database Toolset to version 1.8.5 or later, which contains the fix. If immediate upgrading is not possible, implement temporary workarounds. Restrict file access permissions to the minimum necessary, ensuring the web server user has limited access to the file system. Implement strict input validation on any user-supplied file paths to prevent path traversal attacks. Consider using a Web Application Firewall (WAF) with rules to block attempts to access files outside of the intended directory. Regularly review file system permissions and access logs for suspicious activity.