Plataforma
wordpress
Componente
upc-ean-barcode-generator
Corrigido em
2.0.3
CVE-2025-53588 identifies an Arbitrary File Access vulnerability within the UPC/EAN/GTIN Code Generator, a WordPress plugin. This flaw allows attackers to potentially read sensitive files from the server due to improper input validation. Versions 0.0.0 through 2.0.2 are affected. A fix is available in version 2.0.3.
The vulnerability stems from a path traversal flaw, enabling an attacker to manipulate file paths and access files outside the intended directory. Successful exploitation could lead to the disclosure of sensitive information such as configuration files, database credentials, or even source code. Depending on the files accessible, this could facilitate further attacks, including privilege escalation or data breaches. The impact is amplified if the server hosts other critical applications or data.
This CVE was published on 2025-08-28. Currently, there are no known public exploits or active campaigns targeting this vulnerability. The CVSS score of 7.7 indicates a high probability of exploitation if the vulnerability is exposed. It is not currently listed on the CISA KEV catalog.
WordPress websites utilizing the UPC/EAN/GTIN Code Generator plugin, particularly those running older, unpatched versions (0.0.0–2.0.2), are at risk. Shared hosting environments where users have limited control over plugin installations are also particularly vulnerable.
• wordpress / composer / npm:
grep -r "../" /var/www/html/wp-content/plugins/upc-ean-barcode-generator/*• generic web:
curl -I 'http://your-wordpress-site.com/wp-content/plugins/upc-ean-barcode-generator/../../../../etc/passwd' # Check for file accessdisclosure
Status do Exploit
EPSS
0.06% (percentil 18%)
CISA SSVC
Vetor CVSS
The primary mitigation is to immediately upgrade the UPC/EAN/GTIN Code Generator plugin to version 2.0.3 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on the WordPress installation to minimize the potential damage from a successful exploit. Regularly review WordPress plugin installations and remove any unused or outdated plugins.
Actualice el plugin UPC/EAN/GTIN Code Generator a la última versión disponible para solucionar la vulnerabilidad de recorrido de ruta. Esta actualización debe mitigar el riesgo de eliminación arbitraria de archivos en su sitio de WordPress.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2025-53588 is a HIGH severity vulnerability allowing attackers to read arbitrary files on a WordPress server due to a path traversal flaw in the UPC/EAN/GTIN Code Generator plugin.
You are affected if you are using UPC/EAN/GTIN Code Generator versions 0.0.0 through 2.0.2. Check your plugin versions immediately.
Upgrade the UPC/EAN/GTIN Code Generator plugin to version 2.0.3 or later. Consider WAF rules as a temporary mitigation if upgrading is not immediately possible.
As of now, there are no confirmed reports of active exploitation, but the high CVSS score suggests a potential risk.
Check the plugin's official website or WordPress plugin repository for updates and advisories related to CVE-2025-53588.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.