PT-2025-38096 · WordPress · Simple History

Jonas Benjamin Friedli · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-10050

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Developer Loggers for Simple History plugin for WordPress versions prior to 0.6

Description The Developer Loggers for Simple History plugin for WordPress is susceptible to a Local File Inclusion issue via the enabled loggers parameter. This allows authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server. Successful exploitation can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted.

Recommendations Update the Developer Loggers for Simple History plugin to version 0.6 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-10050

Affected Products

Simple History

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10050 · Security Note
• https://twitter.com/CVEnew/status/1968190750409068802 · Twitter Post
• https://t.me/cveNotify/135610 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b2ea3a9e-2a9a-4628-8ea1-e18e756f915f?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3361543%40developer-loggers-for-simple-history&new=3361543%40developer-loggers-for-simple-history&sfp_email=&sfph_mail= · Note
• https://twitter.com/VulmonFeeds/status/1968183312368677002 · Twitter Post
• https://t.me/CVEtracker/32703 · Telegram Post