Critical · published December 23, 2025
🚨 Unauthenticated attackers can peek into your WordPress files with just a twisted URL! This vulnerability in the PhastPress plugin affects all versions up to 3.7! 🔥 Think of it like a sneaky delivery driver who can read the contents of unopened packages just by knowing their tracking number — this bug lets them read sensitive files like wp-config.php without ever ringing the doorbell. An attacker could gain unauthorized access to critical information, including database credentials and other sensitive configurations. This could lead to complete control over your WordPress site, potentially causing an absolute disaster if they decide to wreak havoc or steal data.
Think of it like a sneaky delivery driver who can read the contents of unopened packages just by knowing their tracking number — this bug lets them read sensitive files like wp-config.php without ever ringing the doorbell. The vulnerability stems from how the `getExtensionForURL()` function handles URL-decoded paths versus how `appendNormalized()` strips parts of those paths after a null byte injection. This discrepancy allows attackers to exploit the system and read arbitrary files just by appending a double URL-encoded null byte to the file path.
An attacker could gain unauthorized access to critical information, including database credentials and other sensitive configurations. This could lead to complete control over your WordPress site, potentially causing an absolute disaster if they decide to wreak havoc or steal data. Immediately update the PhastPress plugin to version 3.8 or later, where this vulnerability has been patched. Additionally, audit your website for any unusual file access and consider implementing security measures such as firewall rules to restrict unauthorized access. You've got this! Follow these steps and you'll secure your site in no time! 🛡️