CVE-2025-32509
Published: 11 April 2025
Summary
CVE-2025-32509 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a path traversal flaw, tracked as CWE-22, in the WPMinds Simple WP Events WordPress plugin. It affects all versions from the initial release through 1.8.17 and permits improper pathname limitation that can be abused to reach restricted directories.
An unauthenticated attacker can exploit the issue over the network without user interaction or credentials. Successful exploitation allows arbitrary file deletion that produces a high availability impact while leaving confidentiality and integrity unaffected, consistent with the CVSS 7.5 rating.
The single reference from Patchstack describes the flaw as an arbitrary file deletion vulnerability in the same plugin version range but supplies no explicit mitigation steps or patch details. The associated EPSS score has remained flat at 0.0115 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10784
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through <= 1.8.17.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.