CVE-2025-26540: Path Traversal in Helloprint WordPress Plugin

The primary impact of this vulnerability is the ability for an attacker to read arbitrary files on the server hosting the WordPress site. This could include sensitive configuration files, database credentials, source code, or other confidential data. Successful exploitation could lead to complete compromise of the web server and potentially the entire network if the server has access to other resources. While the vulnerability description doesn't explicitly mention it, a successful file read could reveal credentials used to access other systems, enabling lateral movement. The blast radius extends to any data accessible by the web server user account.

1. Reserved2025-02-12
2. Published2025-03-03
3. Modified2026-04-28
4. EPSS updated2026-04-02

The recommended mitigation is to immediately upgrade the Helloprint WordPress plugin to version 2.0.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting file access permissions on the server. Specifically, ensure that the web server user account has minimal privileges and cannot access sensitive files outside of the webroot. Web Application Firewall (WAF) rules can be configured to block requests containing path traversal sequences (e.g., ../). After upgrading, verify the fix by attempting to access a non-public file via a path traversal request; the request should be denied.