CVE-2025-25130
Published: 03 March 2025
Summary
CVE-2025-25130 is a high-severity Relative Path Traversal (CWE-23) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25130 is a Relative Path Traversal vulnerability (CWE-23) in the WordPress plugin Delete Comments By Status, developed by Shah Alom. This issue affects the plugin from unknown initial versions through version 2.1.1.
The vulnerability can be exploited by an unauthenticated attacker over the network (AV:N), though it requires high attack complexity (AC:H) and user interaction (UI:R), with no privileges required (PR:N) and unchanged scope (S:U). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS 3.1 base score of 7.5, enabling path traversal to potentially access or manipulate files outside intended directories.
Patchstack has documented this vulnerability in its database, providing details via the advisory at https://patchstack.com/database/Wordpress/Plugin/delete-comments-by-status/vulnerability/wordpress-external-video-for-everybody-plugin-2-1-1-cross-site-scripting-xss-vulnerability-3?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5629
Vulnerability details
Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments By Status: from n/a through <= 2.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated path traversal in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for initial access and file manipulation outside intended directories.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents relative path traversal (CWE-23) by validating plugin inputs to block malicious sequences like '../' from accessing unauthorized files.
Mandates timely flaw remediation, including patching the vulnerable Delete Comments By Status plugin versions through 2.1.1 to eliminate the path traversal vulnerability.
Boundary protection via web application firewalls or proxies can block or detect network-based path traversal attempts targeting the WordPress plugin.