CVE-2025-13681

{"id": "CVE-2025-13681", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2026-02-14T04:15:56.123", "references": [{"url": "https://plugins.trac.wordpress.org/browser/bfg-tools-extension-zipper/tags/1.0.7/bfg-tools-extension-zipper.php#L290", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/bfg-tools-extension-zipper/trunk/bfg-tools-extension-zipper.php#L290", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412948%40bfg-tools-extension-zipper&new=3412948%40bfg-tools-extension-zipper", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd95df9-4355-4d57-ba44-59280463e284?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The BFG Tools \u2013 Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files and directories outside the intended `/wp-content/plugins/` directory, which can contain sensitive information such as wp-config.php."}], "lastModified": "2026-02-18T17:52:44.520", "sourceIdentifier": "security@wordfence.com"}