CVE-2025-13972
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Tags
Description
The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Analysis
Arbitrary file read in WatchTowerHQ WordPress plugin versions up to 3.16.0 allows authenticated administrators with valid access tokens to read sensitive server files via path traversal in the 'wht_download_big_object_origin' parameter. The vulnerability exploits insufficient path validation in the handle_big_object_download_request function, potentially exposing database credentials and authentication keys. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical Context
The vulnerability is a classic path traversal flaw (CWE-22) in the WatchTowerHQ plugin's file download handler. The 'wht_download_big_object_origin' parameter is processed by the handle_big_object_download_request function in Download.php without adequate validation to prevent directory traversal sequences (e.g., '../'). This allows an attacker to specify arbitrary file paths on the server rather than only intended download targets. The plugin is a WordPress extension, meaning it operates within the WordPress plugin architecture and has access to the server filesystem through WordPress file handling functions. The vulnerability requires administrator-level privileges and a valid access token, limiting the attack surface to trusted users or those who have compromised admin credentials.
Affected Products
WatchTowerHQ plugin for WordPress in all versions up to and including 3.16.0 is affected. The plugin is hosted on WordPress.org plugin repository (plugins.trac.wordpress.org/browser/watchtowerhq). Exact CPE string not provided in available data, but the scope includes all installations running version 3.16.0 or earlier. WordPress administrators managing this plugin should prioritize identifying and upgrading affected instances.
Remediation
The primary remediation is to upgrade the WatchTowerHQ plugin to version 3.17.0 or later, which addresses the insufficient path validation in handle_big_object_download_request. Users should navigate to WordPress Dashboard > Plugins, locate WatchTowerHQ, and apply the available update. For immediate risk reduction pending patching, restrict the 'wht_download_big_object_origin' parameter usage by disabling administrator-level access for untrusted users, implementing strong password policies, and enabling two-factor authentication on administrator accounts to prevent token compromise. Verify that only necessary administrators retain access to the plugin's download functions. Additional details and verification of patch availability are available via the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/13fcbff8-8560-48ca-82df-8b620961d9c6.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today