PhastPress CVE-2025-14388

No special conditions beyond the PhastPress plugin (version <= 3.7) being installed and active on the WordPress site; exploitation is remote and unauthenticated (PR:N) with no user interaction (UI:N) against default configurations. The concrete prerequisite is the ability to reach the plugin's optimized-file-serving endpoint and supply a path with a double URL-encoded null byte (%2500) followed by an allowed extension such as .txt. The main limiting factor is simply whether the vulnerable plugin is present - there is no authentication, privilege, or non-default-configuration barrier described, though the practical blast radius depends on which sensitive files (notably wp-config.php) reside within the readable webroot.

Multiple signals conflict here and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) legitimately supports remote, unauthenticated, low-complexity exploitation against default installs, which is why the base score reaches 9.8. However, the 9.8 is inflated by the I:H and A:H impact metrics: the described vulnerability is an arbitrary file READ (CWE-158, improper null termination), which directly breaks confidentiality only - there is no described write, modification, or availability impact, so the integrity and availability 'High' ratings appear overstated and should be treated as confidentiality-dominant. Against that, EPSS is low at 0.48% (40th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or imminent mass exploitation. The real risk is nonetheless meaningful because the canonical target is wp-config.php, which exposes database credentials and WordPress secret keys - a confidentiality breach that can cascade into full site compromise. Net assessment: a genuinely serious unauthenticated information-disclosure flaw worth prompt patching where the plugin is installed, but not a 'drop everything' internet-wide emergency given the low deployment footprint and absence of exploitation evidence. The 'RCE' tag overstates the primary impact - code execution is at best an indirect downstream consequence of leaked credentials, not a direct effect of this bug.

An unauthenticated attacker identifies a WordPress site running PhastPress <= 3.7 and sends a crafted request to the plugin's file-serving endpoint, appending a double URL-encoded null byte and an allowed extension (e.g. wp-config.php%2500.txt). The extension check in getExtensionForURL() sees '.txt' and passes, while appendNormalized() truncates at the null byte and builds the real path to wp-config.php, returning its contents - exposing database credentials and secret keys. No public exploit code is referenced in the provided data, but the technique is described in precise detail in the Wordfence advisory.