CVE-2025-39473: Path Traversal in Seofy Core

The Path Traversal vulnerability in Seofy Core allows an attacker to bypass intended access restrictions and include arbitrary files on the server. By manipulating file paths, an attacker can potentially access sensitive configuration files, source code, or other critical data. Successful exploitation could lead to the disclosure of database credentials, API keys, or other confidential information. In a worst-case scenario, an attacker could leverage this vulnerability to execute arbitrary PHP code, effectively gaining control of the affected WordPress site. This is similar to other Local File Inclusion vulnerabilities where attackers leverage path manipulation to gain unauthorized access.

1. Reserved2025-04-16
2. Published2025-06-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-39473 is to immediately upgrade Seofy Core to version 1.6.11 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting file access permissions on the server, implementing strict input validation to sanitize user-supplied file paths, and utilizing a Web Application Firewall (WAF) to filter out malicious requests. Monitor access logs for suspicious file inclusion attempts. After upgrading, confirm the fix by attempting to access a restricted file via the vulnerable endpoint and verifying that access is denied.