CVE-2025-60242: Arbitrary File Access in Anatoly Download Counter

The core of this vulnerability lies in improper input validation, specifically a lack of restriction on file paths. An attacker can craft a malicious URL containing path traversal sequences (e.g., ../) to navigate outside the intended download directory. This allows them to access files they shouldn't, potentially including configuration files, sensitive data, or even parts of the server's codebase. The potential impact ranges from information disclosure to, in more severe cases, potential code execution if the attacker can leverage the accessed files to compromise the server further. While direct code execution isn't inherent to the path traversal itself, it could be a stepping stone for other attacks.

1. Reserved2025-09-25
2. Published2025-11-06
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the Anatoly Download Counter plugin to version 1.4.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the plugin's download functionality. Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../, ..\). Regularly scan your WordPress installation for vulnerable plugins using security scanning tools. Verify the upgrade by attempting to access files outside the intended download directory – access should be denied.

Active installs

30

Plugin rating