CVE-2025-58972CWE-35

CVE-2025-58972

High · published November 6, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

⚡ A sneaky path traversal vulnerability lurks in the Barcode Scanner with Inventory & Order Manager, allowing attackers to access sensitive files on the server! 🔍 Think of it like a delivery driver who misreads the address and delivers packages to the wrong houses—this vulnerability lets attackers access files they shouldn’t even see! 📦 If exploited, an attacker could manipulate the path to gain access to restricted files, putting sensitive data at serious risk. With the right twist of a URL, they could potentially read server configurations or access user data, leading to devastating consequences! 🔥

Put simply

Think of it like a delivery driver who misreads the address and delivers packages to the wrong houses—this vulnerability lets attackers access files they shouldn’t even see! 📦 This path traversal vulnerability allows attackers to escape the intended directory structure by using encoded sequences like '../', which can lead to unauthorized file access through crafted requests. It affects Barcode Scanner with Inventory & Order Manager versions up to and including 1.10.4.

What to do

If exploited, an attacker could manipulate the path to gain access to restricted files, putting sensitive data at serious risk. With the right twist of a URL, they could potentially read server configurations or access user data, leading to devastating consequences! 🔥 To secure your system, immediately upgrade to version 1.10.5 or later. Additionally, implement robust input validations to ensure user-supplied paths cannot traverse directories. Regularly audit and monitor file access logs for suspicious activity. You've got this! With these steps, your system will be as secure as a vault! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:54Z
    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.10.4 - Path Traversal vulnerability
    cvelistv5