PT-2026-21157 · Unknown · Vanquish User Extra Fields

Publicado 2026-02-20 · Atualizado 2026-02-22 · CVE-2025-69376

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vanquish User Extra Fields versions prior to 17.1

Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' issue. This allows for potential unauthorized access or manipulation of files outside the intended directory.

Recommendations Update to version 17.1 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-69376

Produtos afetados

Vanquish User Extra Fields

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-69376 · Nota de Segurança
• https://twitter.com/CVEnew/status/2025425493663912200 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/wp-user-extra-fields/vulnerability/wordpress-user-extra-fields-plugin-17-0-arbitrary-file-deletion-vulnerability?_s_id=cve · Nota