CVE-2025-14388
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-14388 is a critical-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-14388 is an unauthenticated arbitrary file read vulnerability in the PhastPress plugin for WordPress, affecting all versions up to and including 3.7. The issue arises from a discrepancy in path handling: the getExtensionForURL() function performs extension validation on URL-decoded paths, while appendNormalized() strips everything after a null byte before constructing the filesystem path. This allows null byte injection, classified under CWE-158 (Improper Neutralization of Null Byte or NUL Character), with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction or privileges required. By appending a double URL-encoded null byte (%2500) followed by an allowed extension such as .txt to a target file path, they can bypass extension checks and read arbitrary files from the webroot, including sensitive files like wp-config.php.
References provided include code locations in the plugin's phast.php file (lines 9570, 9597, 9608, and 9641 in tag 3.6) and changeset 3418139 at the WordPress plugins trac repository, which highlight the vulnerable functions and likely indicate the applied fix. Mitigation requires updating the PhastPress plugin to a version beyond 3.7.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204781
Vulnerability Data
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded…
more
paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires neutralizing or rejecting malformed characters such as NUL before they reach downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.