What is the CVSS score of CVE-2025-13377?

CVE-2025-13377 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-13377?

A critical vulnerability in the 10Web Booster WordPress plugin allows attackers with basic user account access to delete arbitrary folders on web servers, potentially resulting in complete data loss…. A patch is available.

How to fix or mitigate CVE-2025-13377?

Within 24 hours: Identify all WordPress installations using 10Web Booster plugin and disable or remove it immediately. Within 7 days: Apply plugin update to version 2.32.8 or later on all affected systems and conduct filesystem integrity verification. Within 30 days: Audit access logs for suspicious file deletion activity, review user account permissions to restrict Subscriber-level access where possible, and implement a plugin management policy requiring automatic security updates.

PHP CVE-2025-13377

EUVD-2025-201539 CRITICAL

Path Traversal (CWE-22)

2025-12-06 security@wordfence.com

PHP WordPress Denial Of Service Path Traversal 10web Booster Wordpress Plugin 10Web

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:37 euvd

EUVD-2025-201539

Analysis Generated

Mar 15, 2026 - 17:37 vuln.today

Patch released

Mar 15, 2026 - 17:37 nvd

Patch available

CVE Published

Dec 06, 2025 - 07:15 nvd

CRITICAL 9.6

DescriptionCVE.org

The 10Web Booster - Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.

Analysis

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.