PT-2025-52195 · WordPress · Wp Webhooks

Phat Rio · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-66074

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Webhooks versions through 3.3.8

Description The software contains a flaw related to unrestricted file uploads with dangerous file types, enabling path traversal. This allows for potential unauthorized access or manipulation of files on the system.

Recommendations Update WP Webhooks to a version later than 3.3.8.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-66074

Affected Products

Wp Webhooks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-66074 · Security Note
• https://t.me/CVEtracker/40123 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2001728107171242127 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-arbitrary-file-upload-vulnerability?_s_id=cve · Note