CVE-2025-26753
Published: 25 February 2025
Summary
CVE-2025-26753 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents path traversal vulnerabilities by enforcing input validation mechanisms at entry points to reject or sanitize malicious pathnames like '../' sequences.
SI-2 ensures timely identification, reporting, and patching of flaws such as this arbitrary file disclosure vulnerability in the videowhisper-live-streaming-integration plugin up to version 6.2.
AC-3 enforces access control policies to restrict unauthorized access to files and directories, mitigating improper pathname limitations that allow traversal to sensitive areas.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WordPress plugin enables unauthenticated remote file disclosure, directly mapping to exploitation of public-facing apps (T1190) and facilitating local system data collection via arbitrary file reads (T1005).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through <= 6.2.
Deeper analysisAI
CVE-2025-26753 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified as CWE-22, in the videowhisper-live-streaming-integration WordPress plugin, also known as Broadcast Live Video. This issue affects all versions up to and including 6.2, allowing attackers to bypass directory restrictions through manipulated pathnames.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, no required privileges or user interaction, and high impact on confidentiality. Unauthenticated remote attackers can exploit it to achieve arbitrary file disclosure by traversing to restricted directories and downloading sensitive files.
Patchstack's advisory details this as an arbitrary file download vulnerability in plugin version 6.2, available at https://patchstack.com/database/Wordpress/Plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-videowhisper-live-streaming-integration-plugin-6-2-arbitrary-file-download-vulnerability?_s_id=cve, and outlines mitigation recommendations for affected WordPress installations.
Details
- CWE(s)