平台
wordpress
组件
error-log-viewer
修复版本
1.1.7
CVE-2025-9950 describes an Arbitrary File Access vulnerability discovered in the BestWebSoft Error Log Viewer plugin for WordPress. This vulnerability allows authenticated attackers with administrator privileges to read arbitrary files on the server, potentially exposing sensitive information such as configuration files or database credentials. The vulnerability affects versions from 0.0.0 up to and including 1.1.6. A patch is expected from the vendor.
The primary impact of CVE-2025-9950 is the potential for unauthorized access to sensitive files on the WordPress server. An attacker who has successfully exploited this vulnerability can leverage the rrrlgvwrgetfile function to read any file the webserver process has access to. This could include configuration files containing database passwords, API keys, or other credentials. Successful exploitation could lead to complete compromise of the WordPress instance and potentially the underlying server. The ability to read arbitrary files represents a significant data breach risk and could facilitate further attacks, such as privilege escalation or data exfiltration.
CVE-2025-9950 was publicly disclosed on 2025-10-11. There are currently no known public proof-of-concept exploits available, but the ease of exploitation (requiring only administrator access) suggests a moderate risk of exploitation. The vulnerability has been added to the CISA KEV catalog, indicating a potential for widespread exploitation. Monitor security advisories from WordPress and BestWebSoft for updates.
WordPress websites using the BestWebSoft Error Log Viewer plugin, particularly those with administrator accounts that have weak passwords or are otherwise vulnerable to compromise, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.
• wordpress / composer / npm:
grep -r 'rrrlgvwr_get_file' /var/www/html/wp-content/plugins/error-log-viewer/• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/error-log-viewer/rrrlgvwr_get_file?file=/etc/passwd• wordpress / composer / npm:
wp plugin list | grep error-log-viewerdisclosure
漏洞利用状态
EPSS
0.15% (35% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-9950 is to upgrade the BestWebSoft Error Log Viewer plugin to a patched version as soon as it becomes available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, restrict file permissions on the server to minimize the potential damage from a successful attack. Implement a Web Application Firewall (WAF) with rules to block attempts to access files outside of the intended directory. Monitor WordPress logs for suspicious activity, particularly requests to unusual file paths.
Actualice el plugin Error Log Viewer by BestWebSoft a la última versión disponible, ya que contiene la corrección para esta vulnerabilidad de Directory Traversal. Asegúrese de realizar una copia de seguridad completa de su sitio web antes de actualizar cualquier plugin.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-9950 is a vulnerability in the BestWebSoft Error Log Viewer plugin for WordPress allowing authenticated administrators to read arbitrary files on the server.
You are affected if your WordPress site uses the BestWebSoft Error Log Viewer plugin in versions 0.0.0 through 1.1.6.
Upgrade the BestWebSoft Error Log Viewer plugin to a patched version as soon as it's available. Disable the plugin as a temporary workaround.
While no public exploits are currently known, the vulnerability's ease of exploitation suggests a potential for active exploitation.
Check the BestWebSoft website and WordPress plugin repository for updates and advisories related to CVE-2025-9950.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。