What is the CVSS score of CVE-2025-25122?

CVE-2025-25122 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WizShop are affected by CVE-2025-25122?

WizShop plugin versions up to 3.0.2 contain a path traversal vulnerability (CVE-2025-25122) that could allow remote code execution through arbitrary PHP file inclusion; however, exploitation requires…

How to fix or mitigate CVE-2025-25122?

Within 24 hours: Inventory all WordPress/web instances running WizShop plugin and document current versions. Within 7 days: Contact plugin vendor for patch status and timeline; if no patch forthcoming, consider disabling the plugin or restricting access to administrative functions only. Within 30 days: Upgrade to patched version immediately upon vendor release, or migrate to alternative functionality if no patch is released within 60 days.

WizShop CVE-2025-25122

HIGH

Path Traversal: '.../...//' (CWE-35)

2025-03-03 audit@patchstack.com

PHP Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:22 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 8.1

DescriptionCVE.org

Path Traversal vulnerability in NotFound WizShop allows PHP Local File Inclusion. This issue affects WizShop: from n/a through 3.0.2.

AnalysisAI

Path traversal in WizShop plugin versions through 3.0.2 enables remote attackers to include arbitrary PHP files from the local filesystem, potentially achieving remote code execution. Despite the high CVSS score (8.1), this vulnerability shows low real-world exploitation probability with EPSS at 0.22% (45th percentile). The attack complexity is rated HIGH (AC:H), requiring specific conditions to successfully exploit. No active exploitation confirmed; not listed in CISA KEV, and no public proof-of-concept identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-35 (Path Traversal), a class of input validation flaws where user-controlled data influences file path construction without proper sanitization. PHP Local File Inclusion (LFI) occurs when an application dynamically includes files based on user input, allowing traversal sequences (../) or absolute paths to reference files outside intended directories. In PHP applications like WizShop, successful LFI can lead to code execution if attackers can include files containing PHP code, whether uploaded files, log files with injected content, or PHP session files. The vulnerability affects WizShop through version 3.0.2, suggesting improper validation of file path parameters in plugin functionality. Patchstack, a WordPress security platform, reported this issue, indicating WizShop is likely a WordPress plugin despite conflicting reference URLs mentioning wp-spell-check.

Affected ProductsAI

NotFound WizShop plugin for WordPress, versions from initial release through 3.0.2 inclusive. The vulnerability report originates from Patchstack's WordPress plugin vulnerability database, though reference URLs contain inconsistencies mentioning wp-spell-check plugin. Organizations should verify they are running WizShop plugin and check installed version against the 3.0.2 threshold. CPE data not provided in source intelligence. Vendor advisory details available at Patchstack database, though provided reference URLs appear to contain incorrect plugin identifiers in the path structure.

RemediationAI

Upgrade WizShop plugin to version 3.0.3 or later if available, checking the official WordPress plugin repository or vendor website for the patched release. Review Patchstack database entry at https://patchstack.com/database/ for confirmed fix version and vendor security bulletin. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: Disable the WizShop plugin entirely until patching is possible (eliminates attack surface but removes plugin functionality); restrict plugin file access permissions to prevent inclusion of writable directories like uploads or logs (may break legitimate plugin features requiring file operations); implement web application firewall rules blocking common path traversal patterns in requests to WizShop endpoints, specifically filtering dot-dot-slash sequences and absolute path references (may cause false positives requiring tuning). Configure PHP settings to disable allow_url_include and restrict open_basedir to web root only (defense-in-depth measure that limits LFI impact but does not prevent the vulnerability). Monitor web server logs for suspicious file path patterns in requests to plugin files.