CVE-2025-13070CWE-22path-traversal

CVE-2025-13070

Medium · published December 9, 2025

CVSS v3.1
6.6
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-09T21:17Z
References (1)
https://wpscan.com/vulnerability/deb52d69-d7f8-43a5-a709-1f543fd343c6/ · [email protected]
EPSS history
Timeline
  • 09 DEC 06:00Z
    CSV to SortTable <= 4.2 - Contributor+ LFI
    cvelistv5