WordPress WPLMS Plugin <= 1.9.9.5.4 - Arbiträres Löschen von Dateien Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to bypass security controls and read files outside of the intended directory. This could expose sensitive information such as configuration files, database credentials, or even source code. Successful exploitation could lead to complete compromise of the WordPress instance and potentially the underlying server. The ability to read arbitrary files significantly expands the attack surface and allows for reconnaissance and further exploitation attempts. While direct remote code execution might not be immediately possible, the information gained could be leveraged to identify and exploit other vulnerabilities.

Websites using WPLMS plugin versions 0.0.0 through 1.9.9.5.4 are at risk. Shared hosting environments are particularly vulnerable, as they often have limited control over file permissions and server configurations. WordPress sites with default or weak security settings are also at increased risk.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/wplms/*

• generic web:

curl -I "http://your-wordpress-site.com/wp-content/plugins/wplms/path/to/file..%2e%2e/sensitive_file.txt"

1. 2026-01-22Disclosure

   disclosure

1. Reserviert2025-12-29
2. Veröffentlicht2026-01-22
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade WPLMS to a version containing the security fix. As no fixed version is currently specified, monitor the VibeThemes website and WordPress plugin repository for updates. As a temporary workaround, restrict file access permissions on the server to minimize the potential damage from a successful exploit. Implement a Web Application Firewall (WAF) with rules to block attempts to access files outside of the intended directories, specifically looking for path traversal sequences like '../'. Regularly review WordPress plugin installations and remove any unused or outdated plugins.