PT-2025-16933 · WordPress · Wp Editor

Nquangit

·

Published

2025-04-17

·

Updated

2025-07-09

·

CVE-2025-3294

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WP Editor plugin for WordPress versions up to, and including, 1.2.9.1
Description The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server, which may make remote code execution possible assuming the files can be written to by the web server.
Recommendations For WP Editor plugin for WordPress versions up to, and including, 1.2.9.1, update to a version higher than 1.2.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3294

Affected Products

Wp Editor