PT-2025-14038 · Unknown · Include Url

Timomangcut · Published 2025-04-01 · Updated 2025-04-01 · CVE-2025-30594

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NotFound Include URL versions 0.3.5 and earlier

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability affects the Include URL feature, allowing unauthorized access to files outside the intended directory.

Recommendations For versions 0.3.5 and earlier, consider restricting access to the Include URL feature until a patch is available. As a temporary workaround, limit the paths that can be accessed through the Include URL to prevent traversal outside the restricted directory.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-30594

Affected Products

Include Url

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-30594 · Security Note
• https://patchstack.com/database/wordpress/plugin/include-url/vulnerability/wordpress-include-url-0-3-5-arbitrary-file-download-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1906977426233499680 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/include-url/vulnerability/wordpress-include-url-0-3-5-arbitrary-file-download-vulnerability?_s_id=cve · Note