CVE-2025-3294

CVSS 3.1 Score 7.2 of 10 (high)

Details

Published Apr 17, 2025
CWE ID 22

Summary

CVE-2025-3294 is a vulnerability affecting the WP Editor plugin for WordPress. This issue, present in versions up to 1.2.9.1, allows authenticated attackers with Administrator-level access to perform arbitrary file updates. The lack of file path validation in the plugin exposes the vulnerability, allowing attackers to potentially overwrite critical files and introduce remote code execution, depending on the web server's permissions.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share