BeeTeam368 Extensions Pro <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion

The Directory Traversal vulnerability in BeeTeam368 Extensions Pro allows authenticated attackers to read and potentially modify files outside the plugin's designated directory. The most severe consequence is the ability to delete the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file effectively leads to a complete site takeover, granting the attacker full control over the WordPress installation. This vulnerability is particularly concerning because it requires only Subscriber-level access, a relatively low privilege within a WordPress environment, making a large number of users potentially vulnerable. The impact is similar to other file manipulation vulnerabilities where attackers can gain unauthorized access to critical system files.

WordPress sites utilizing the BeeTeam368 Extensions Pro plugin, particularly those with Subscriber-level users or higher, are at risk. Shared hosting environments where multiple WordPress installations share the same server resources are also at increased risk, as a compromise of one site could potentially lead to access to others. Sites using older, unpatched versions of the plugin are especially vulnerable.

• wordpress / composer / npm:

grep -r "handle_live_fn()" /var/www/html/wp-content/plugins/bee-team368-extensions-pro/

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/bee-team368-extensions-pro/../wp-config.php

• wordpress / composer / npm:

wp plugin list --status=all | grep 'bee-team368-extensions-pro'

1. 2025-06-28Disclosure

   disclosure

1. Reserviert2025-06-19
2. Veröffentlicht2025-06-28
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6379 is to immediately upgrade the BeeTeam368 Extensions Pro plugin to version 2.3.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file access permissions within the WordPress environment. Implement strict file access controls to limit the ability of Subscriber-level users to modify files outside of the plugin's designated directory. While not a complete solution, a Web Application Firewall (WAF) configured to block requests containing directory traversal sequences (e.g., ../) can provide an additional layer of defense. After upgrading, verify the fix by attempting to access files outside the plugin's intended directory using a web browser or a tool like curl – access should be denied.