Platform
wordpress
Component
delete-comments-by-status
Fixed in
2.1.2
A Path Traversal vulnerability has been identified in the Delete Comments By Status plugin for WordPress. This flaw allows attackers to potentially access sensitive files and directories on the server by manipulating file paths. The vulnerability affects versions from 0.0.0 up to and including 2.1.1, and a fix is available in version 2.1.2.
The Path Traversal vulnerability in Delete Comments By Status allows an attacker to bypass intended access restrictions and read files outside of the webroot. This could expose sensitive configuration files, source code, database credentials, or other confidential data. Successful exploitation could lead to complete compromise of the WordPress instance and potentially the underlying server. The attacker could gain access to critical system files, leading to data breaches, system modifications, or even remote code execution if combined with other vulnerabilities.
This vulnerability was publicly disclosed on March 3, 2025. No public proof-of-concept exploits are currently known. The CVSS score of 7.5 (High) indicates a significant risk. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.19% (41% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-25130 is to immediately upgrade the Delete Comments By Status plugin to version 2.1.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences (e.g., ../). Carefully review file permissions to ensure that sensitive files are not accessible from the webroot. Monitor WordPress logs for unusual file access attempts.
Actualice el plugin Delete Comments By Status a la última versión disponible para mitigar la vulnerabilidad de Path Traversal. Verifique la página del plugin en wordpress.org para obtener la versión más reciente y las instrucciones de actualización. Asegúrese de realizar una copia de seguridad de su sitio web antes de actualizar cualquier plugin.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-25130 is a Path Traversal vulnerability affecting the Delete Comments By Status WordPress plugin, allowing attackers to read arbitrary files.
You are affected if you are using Delete Comments By Status versions 0.0.0 through 2.1.1. Upgrade to 2.1.2 or later to mitigate the risk.
Upgrade the Delete Comments By Status plugin to version 2.1.2 or later. Consider WAF rules as a temporary workaround if immediate upgrade is not possible.
There are currently no reports of active exploitation, but the vulnerability is publicly known and poses a significant risk.
Check the Delete Comments By Status plugin page on WordPress.org for updates and security advisories.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.