CVE-2025-3295

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3295
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail= Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:benjaminrojas:wp_editor:*:*:*:*:*:wordpress:*:*
History

09 Jul 2025, 20:16

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail= - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail= - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0?source=cve - Third Party Advisory
Summary
  • (es) El complemento WP Editor para WordPress es vulnerable a la lectura arbitraria de archivos en todas las versiones hasta la 1.2.9.1 incluida. Esto permite que atacantes autenticados, con acceso de administrador o superior, lean archivos arbitrarios en el servidor del sitio afectado, lo que podría revelar información confidencial.
CPE cpe:2.3:a:benjaminrojas:wp_editor:*:*:*:*:*:wordpress:*:*
First Time Benjaminrojas wp Editor
Benjaminrojas

17 Apr 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-17 06:15

Updated : 2025-07-09 20:16

NVD link : CVE-2025-3295

Mitre link : CVE-2025-3295

CVE.ORG link : CVE-2025-3295

JSON object : View

Products Affected

benjaminrojas

  • wp_editor
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')