Cyber Resilience

CVE-2025-26534

High

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0030 53.3th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26534 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26534 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the Helloprint WordPress plugin. This issue affects Helloprint versions from n/a through 2.0.7. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity primarily due to its potential for availability disruption.

Unauthenticated remote attackers can exploit this path traversal flaw over the network with low complexity and no user interaction required. By manipulating pathnames, attackers can achieve arbitrary file deletion on the targeted system, resulting in high-impact denial of service as reflected in the CVSS availability metric, with a changed scope affecting broader system components.

Patchstack's advisory documents this as an arbitrary file deletion vulnerability specifically in the WordPress Helloprint plugin version 2.0.7, providing details on the issue in their vulnerability database.

EU & UK References

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Why these techniques?

Path traversal in public-facing WordPress plugin enables unauthenticated remote exploitation (T1190) and arbitrary file deletion causing DoS (T1485).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-67963Shared CWE-22
CVE-2026-4351Shared CWE-22
CVE-2026-22448Shared CWE-22
CVE-2025-7359Shared CWE-22
CVE-2025-68901Shared CWE-22
CVE-2025-14868Shared CWE-22
CVE-2024-8898Shared CWE-22
CVE-2025-22663Shared CWE-22
CVE-2026-32522Shared CWE-22
CVE-2026-45727Shared CWE-22

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly remediates the path traversal flaw in the Helloprint WordPress plugin through timely patching, eliminating the vulnerability to arbitrary file deletion.

prevent

Validates user-supplied pathnames to prevent traversal sequences like '../', blocking unauthorized access and deletion outside restricted directories.

preventdetect

Monitors and filters network traffic at boundaries to detect and block path traversal payloads targeting the vulnerable plugin endpoint.

References