CVE-2025-60227: Arbitrary File Access in WP Pipes

The Arbitrary File Access vulnerability in WP Pipes allows an attacker to bypass intended access controls and read arbitrary files from the server's file system. This could expose sensitive data such as configuration files, database credentials, or even source code. Successful exploitation could lead to complete compromise of the WordPress installation and potentially the underlying server. The attacker could gain access to critical system information, modify files, or execute malicious code, depending on the permissions of the web server user.

1. Reserved2025-09-25
2. Published2025-10-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-60227 is to upgrade WP Pipes to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as restricting file access permissions for the web server user or implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Thoroughly test any configuration changes in a staging environment before applying them to production. After upgrade, confirm by attempting to access a non-public file via the vulnerable endpoint and verifying that access is denied.

Active installs

400

Plugin rating