CVE-2025-26905

Summary

CVE-2025-26905 is a path traversal vulnerability affecting Estatik, a plugin used in WordPress websites. The flaw, specifically an improper limitation of a pathname, enables PHP Local File Inclusion. This issue allows attackers to potentially gain unauthorized access to sensitive files on affected systems. Estatik versions from n/a through 4.1.9 are impacted by this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.