PT-2025-31734 · WordPress · Bitfire Security – Firewall

Aurélien Bourdois · Published 2025-08-02 · Updated 2025-08-25 · CVE-2025-6722

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security versions prior to 4.6

Description The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is susceptible to sensitive information exposure. The bitfire * directory, created by the plugin, stores potentially sensitive files without access restrictions, allowing unauthenticated attackers to extract data from files such as config.ini and debug.log.

Recommendations Update to version 4.6 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-6722

Affected Products

Bitfire Security – Firewall

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-6722 · Security Note
• https://t.me/cveNotify/133349 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3334399%40bitfire&new=3334399%40bitfire&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/130993 · Telegram Post
• https://t.me/cveNotify/130668 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/72320980-733d-4fe6-9a13-39c476b77298?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1951595767111504020 · Twitter Post
• https://twitter.com/bitfirewall/status/1957487380602187881 · Twitter Post
• https://t.me/CVEtracker/29014 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3335461%40bitfire&new=3335461%40bitfire&sfp_email=&sfph_mail= · Note