CVE-2025-68862
Published: 20 February 2026
Summary
CVE-2025-68862 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Destruction (T1485); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents path traversal vulnerabilities by validating and sanitizing user-supplied pathnames to restrict access to authorized directories only.
Remediates the specific path traversal flaw in Woo File Dropzone through timely identification, reporting, and patching of the vulnerable plugin versions up to 1.1.7.
Enforces access control policies to limit low-privileged users from deleting arbitrary files outside intended directories, mitigating exploitation impact.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables arbitrary file deletion, directly facilitating data destruction (T1485) and file deletion (T1070.004) for availability impact.
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Murtaza Bhurgri Woo File Dropzone woo-file-dropzone allows Path Traversal.This issue affects Woo File Dropzone: from n/a through <= 1.1.7.
Deeper analysisAI
CVE-2025-68862 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified as CWE-22, in the Woo File Dropzone WordPress plugin by Murtaza Bhurgri. This issue affects the plugin from unknown initial versions through 1.1.7. The vulnerability has a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
Low-privileged authenticated users (PR:L) can exploit the path traversal flaw over the network (AV:N) with low attack complexity and no user interaction. Exploitation changes scope (S:C) and enables arbitrary file deletion, resulting in high availability disruption (A:H) without compromising confidentiality or integrity.
The Patchstack advisory describes this as an arbitrary file deletion vulnerability in Woo File Dropzone version 1.1.7 and provides mitigation guidance at https://patchstack.com/database/Wordpress/Plugin/woo-file-dropzone/vulnerability/wordpress-woo-file-dropzone-plugin-1-1-7-arbitrary-file-deletion-vulnerability?_s_id=cve.
Details
- CWE(s)