PT-2025-34199 · WordPress · Wp Webhooks

Phat Rio · Published 2025-08-21 · Updated 2025-09-22 · CVE-2025-8895

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WP Webhooks plugin for WordPress versions up to and including 3.3.5

Description: The WP Webhooks plugin for WordPress is susceptible to arbitrary file copy due to insufficient validation of user-supplied input. This allows unauthenticated attackers to copy arbitrary files on the affected server to arbitrary locations. Exploitation can involve copying the contents of wp-config.php into a text file, potentially revealing database credentials when accessed through a web browser.

Recommendations: Update WP Webhooks plugin to a version later than 3.3.5.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-8895

Affected Products

Wp Webhooks

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8895 · Security Note
• https://twitter.com/CVEnew/status/1958444195326165502 · Twitter Post
• https://wordpress.org/plugins/wp-webhooks · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/de9c9e1e-3c3c-463a-a78c-d8bc7228da93?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3347509%40wp-webhooks%2Ftrunk&old=3327632%40wp-webhooks%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/offseq/status/1958454184384086054 · Twitter Post
• https://twitter.com/cracbot/status/1960296220498256220 · Twitter Post
• https://t.me/CVEtracker/30573 · Telegram Post