Platform
wordpress
Component
upc-ean-barcode-generator
Fixed in
2.0.3
CVE-2025-53588 identifies an Arbitrary File Access vulnerability within the UPC/EAN/GTIN Code Generator, a WordPress plugin. This flaw allows attackers to potentially read sensitive files from the server due to improper input validation. Versions 0.0.0 through 2.0.2 are affected. A fix is available in version 2.0.3.
The vulnerability stems from a path traversal flaw, enabling an attacker to manipulate file paths and access files outside the intended directory. Successful exploitation could lead to the disclosure of sensitive information such as configuration files, database credentials, or even source code. Depending on the files accessible, this could facilitate further attacks, including privilege escalation or data breaches. The impact is amplified if the server hosts other critical applications or data.
This CVE was published on 2025-08-28. Currently, there are no known public exploits or active campaigns targeting this vulnerability. The CVSS score of 7.7 indicates a high probability of exploitation if the vulnerability is exposed. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to immediately upgrade the UPC/EAN/GTIN Code Generator plugin to version 2.0.3 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on the WordPress installation to minimize the potential damage from a successful exploit. Regularly review WordPress plugin installations and remove any unused or outdated plugins.
Actualice el plugin UPC/EAN/GTIN Code Generator a la última versión disponible para solucionar la vulnerabilidad de recorrido de ruta. Esta actualización debe mitigar el riesgo de eliminación arbitraria de archivos en su sitio de WordPress.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-53588 is a HIGH severity vulnerability allowing attackers to read arbitrary files on a WordPress server due to a path traversal flaw in the UPC/EAN/GTIN Code Generator plugin.
You are affected if you are using UPC/EAN/GTIN Code Generator versions 0.0.0 through 2.0.2. Check your plugin versions immediately.
Upgrade the UPC/EAN/GTIN Code Generator plugin to version 2.0.3 or later. Consider WAF rules as a temporary mitigation if upgrading is not immediately possible.
As of now, there are no confirmed reports of active exploitation, but the high CVSS score suggests a potential risk.
Check the plugin's official website or WordPress plugin repository for updates and advisories related to CVE-2025-53588.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.