PT-2026-8044 · WordPress · Extension Zipper+1

Itthidej Aramsri · Published 2026-02-14 · Updated 2026-02-14 · CVE-2025-13681

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BFG Tools – Extension Zipper plugin for WordPress versions through 1.0.7

Description The BFG Tools – Extension Zipper plugin for WordPress is susceptible to a Path Traversal issue. This is caused by inadequate validation of the first file parameter within the zip() function. An attacker with Administrator-level access or higher can potentially read the contents of arbitrary files and directories outside the expected /wp-content/plugins/ directory, potentially exposing sensitive information like wp-config.php.

Recommendations Update the BFG Tools – Extension Zipper plugin to a version newer than 1.0.7.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13681

Affected Products

Bfg Tools – Extension Zipper

Extension Zipper

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13681 · Security Note
• https://plugins.trac.wordpress.org/browser/bfg-tools-extension-zipper/trunk/bfg-tools-extension-zipper.php#L290 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412948%40bfg-tools-extension-zipper&new=3412948%40bfg-tools-extension-zipper · Note
• https://twitter.com/VulmonFeeds/status/2022619774841131420 · Twitter Post
• https://plugins.trac.wordpress.org/browser/bfg-tools-extension-zipper/tags/1.0.7/bfg-tools-extension-zipper.php#L290 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5bd95df9-4355-4d57-ba44-59280463e284?source=cve · Note
• https://twitter.com/CVEarity/status/2022554307208360299 · Twitter Post
• https://twitter.com/CVEnew/status/2022543949827596678 · Twitter Post
• https://t.me/CVEtracker/44673 · Telegram Post