CVE-2025-60242CWE-22path-traversal

CVE-2025-60242

High · published November 6, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

⚡ A crafty path traversal flaw lurks within the Download Counter, allowing attackers to exploit a woeful oversight! Think of your computer as a restaurant kitchen, where a careless delivery person grabs ingredients from any shelf instead of the designated stock. This vulnerability lets attackers sneak into restricted areas and access files they shouldn't — it’s like rummaging through the pantry and grabbing anything they want! If an attacker successfully exploits this vulnerability, they could access sensitive files on your server, potentially leading to data breaches or unauthorized alterations. It’s a dangerous invitation for mischief-makers to stroll through your digital kitchen and serve whatever they please!

Put simply

Think of your computer as a restaurant kitchen, where a careless delivery person grabs ingredients from any shelf instead of the designated stock. This vulnerability lets attackers sneak into restricted areas and access files they shouldn't — it’s like rummaging through the pantry and grabbing anything they want! This path traversal vulnerability allows unauthorized access to files outside the intended directory by manipulating file paths. Versions of the Download Counter from n/a through 1.4 are affected, creating a serious risk if left unaddressed.

What to do

If an attacker successfully exploits this vulnerability, they could access sensitive files on your server, potentially leading to data breaches or unauthorized alterations. It’s a dangerous invitation for mischief-makers to stroll through your digital kitchen and serve whatever they please! To thwart this vulnerability, immediately upgrade to the latest version of Download Counter. Additionally, implement strict input validation to ensure that file paths remain within their proper boundaries. Regular security audits can further help to identify and mitigate such risks. You've got this! Fixing this vulnerability will fortify your defenses and keep those pesky intruders at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:55Z
    WordPress Download Counter plugin <= 1.4 - Arbitrary File Download vulnerability
    cvelistv5