9.8

CVE-2025-14388

PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection

PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
Mögliche Gegenmaßnahme
PhastPress: Update to version 3.8, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerkiboit
≫
Produkt PhastPress
Default Statusunaffected
Version <= 3.7
Version 0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt PhastPress
Version *-3.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.331
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-158 Improper Neutralization of Null Byte or NUL Character

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

https://www.wordfence.com/threat-intel/vulnerabilities/id/eec9bbc0-5a68-4624-a672-bd6227d6fa45?source=cve
https://plugins.trac.wordpress.org/browser/phastpress/tags/3.6/sdk/phast.php#L9641
https://plugins.trac.wordpress.org/browser/phastpress/tags/3.6/sdk/phast.php#L9608
https://plugins.trac.wordpress.org/browser/phastpress/tags/3.6/sdk/phast.php#L9570
https://plugins.trac.wordpress.org/browser/phastpress/tags/3.6/sdk/phast.php#L9597
https://plugins.trac.wordpress.org/changeset/3418139
https://www.wordfence.com/threat-intel/vulnerabilities/id/eec9bbc0-5a68-4624-a672-bd6227d6fa45
Third Party Advisory