CVE-2025-26905
Published: 25 February 2025
Summary
CVE-2025-26905 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26905 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified as CWE-22, in the Estatik WordPress plugin. It allows PHP Local File Inclusion and affects Estatik versions from n/a through <= 4.3.0. The vulnerability was published on 2025-02-25 with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Low-privileged remote attackers (PR:L) can exploit this vulnerability over the network (AV:N) without user interaction, though it requires high attack complexity (AC:H). Successful exploitation enables high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H) through PHP Local File Inclusion, potentially allowing attackers to include and execute arbitrary local files.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/estatik/vulnerability/wordpress-estatik-plugin-4-1-9-local-file-inclusion-vulnerability?_s_id=cve provides further details on the vulnerability in the Estatik WordPress plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5388
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through <= 4.3.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a path traversal vulnerability in a public-facing WordPress plugin enabling PHP local file inclusion with remote exploitation and high impact, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the path traversal flaw in Estatik WordPress plugin versions <=4.3.0 directly prevents PHP Local File Inclusion exploitation.
Validating pathname inputs against traversal sequences like '../' comprehensively blocks unauthorized access to restricted directories in the vulnerable plugin.
Vulnerability scanning identifies the CWE-22 path traversal issue in Estatik plugin, enabling timely remediation.