CVE-2025-69097
Published: 22 January 2026
Summary
CVE-2025-69097 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69097, published on 2026-01-22, is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability (CWE-22) in the VibeThemes WPLMS WordPress plugin (wplms_plugin). It affects all versions from an unspecified starting point through 1.9.9.5.4. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), highlighting its high severity due to network accessibility, low attack complexity, no privileges or user interaction required, changed scope, and high impact on availability.
Unauthenticated remote attackers can exploit this path traversal flaw over the network to perform arbitrary file deletions on the targeted WordPress site. This capability enables denial-of-service disruptions by removing critical files, without affecting confidentiality or integrity.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-4-arbitrary-file-deletion-vulnerability?_s_id=cve characterizes the issue as an arbitrary file deletion vulnerability specifically in WPLMS plugin version 1.9.9.5.4, providing details relevant to mitigation for affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3908
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WordPress plugin enables remote unauthenticated exploitation (T1190) and arbitrary file deletion for DoS/data destruction (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates input validation and sanitization for file paths, directly preventing path traversal exploits that enable arbitrary file deletions in the WPLMS plugin.
SI-2 requires timely identification, reporting, and correction of software flaws like this path traversal vulnerability affecting WPLMS versions through 1.9.9.5.4.
SI-7 employs integrity checks to detect unauthorized file deletions caused by the path traversal exploit, enabling early identification of the denial-of-service impact.