What is the CVSS score of CVE-2025-13972?

CVE-2025-13972 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

WordPress CVE-2025-13972

MEDIUM

Path Traversal (CWE-22)

2025-12-12 security@wordfence.com

Path Traversal WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 4.9

DescriptionCVE.org

The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.

AnalysisAI

Arbitrary file read in WatchTowerHQ WordPress plugin versions up to 3.16.0 allows authenticated administrators with valid access tokens to read sensitive server files via path traversal in the 'wht_download_big_object_origin' parameter. The vulnerability exploits insufficient path validation in the handle_big_object_download_request function, potentially exposing database credentials and authentication keys. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability is a classic path traversal flaw (CWE-22) in the WatchTowerHQ plugin's file download handler. The 'wht_download_big_object_origin' parameter is processed by the handle_big_object_download_request function in Download.php without adequate validation to prevent directory traversal sequences (e.g., '../'). This allows an attacker to specify arbitrary file paths on the server rather than only intended download targets. The plugin is a WordPress extension, meaning it operates within the WordPress plugin architecture and has access to the server filesystem through WordPress file handling functions. The vulnerability requires administrator-level privileges and a valid access token, limiting the attack surface to trusted users or those who have compromised admin credentials.

Affected ProductsAI

WatchTowerHQ plugin for WordPress in all versions up to and including 3.16.0 is affected. The plugin is hosted on WordPress.org plugin repository (plugins.trac.wordpress.org/browser/watchtowerhq). Exact CPE string not provided in available data, but the scope includes all installations running version 3.16.0 or earlier. WordPress administrators managing this plugin should prioritize identifying and upgrading affected instances.

RemediationAI

The primary remediation is to upgrade the WatchTowerHQ plugin to version 3.17.0 or later, which addresses the insufficient path validation in handle_big_object_download_request. Users should navigate to WordPress Dashboard > Plugins, locate WatchTowerHQ, and apply the available update. For immediate risk reduction pending patching, restrict the 'wht_download_big_object_origin' parameter usage by disabling administrator-level access for untrusted users, implementing strong password policies, and enabling two-factor authentication on administrator accounts to prevent token compromise. Verify that only necessary administrators retain access to the plugin's download functions. Additional details and verification of patch availability are available via the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/13fcbff8-8560-48ca-82df-8b620961d9c6.