Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read

The primary impact of CVE-2025-8385 is the unauthorized disclosure of sensitive information. An attacker exploiting this vulnerability could read arbitrary files on the server, potentially including configuration files, database credentials, or even system files like /etc/passwd. While the vulnerability requires a race condition, successful exploitation could lead to significant data breaches and compromise the integrity of the WordPress environment. The ability to read system files could also provide attackers with valuable reconnaissance data for further attacks, such as privilege escalation or lateral movement within the network.

WordPress websites using the Zombify plugin, particularly those with subscriber-level users or those running older versions of the plugin (1.0.0–1.7.5), are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'zf_get_file_by_url' /var/www/html/wp-content/plugins/zombify/

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/plugins/zombify/../../../../etc/passwd'

• wordpress / composer / npm:

wp plugin list --status=active | grep zombify

• wordpress / composer / npm:

wp plugin update zombify --all

1. 2025-10-31Disclosure

   disclosure

1. Reserviert2025-07-30
2. Veröffentlicht2025-10-31
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-8385 is to upgrade the Zombify plugin to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. These may include restricting file access permissions on the server, implementing stricter input validation on the WordPress application, and using a Web Application Firewall (WAF) to filter out malicious requests. Monitor WordPress logs for suspicious activity, particularly requests targeting files outside the plugin's intended directory. After upgrading, confirm the vulnerability is resolved by attempting to access a non-existent file via a forged request and verifying that access is denied.