What is the CVSS score of CVE-2025-25130?

CVE-2025-25130 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Delete Comments By Status are affected by CVE-2025-25130?

CVE-2025-25130 affects the Delete Comments By Status WordPress plugin (versions ≤2.1.1) and allows remote attackers to execute arbitrary PHP code through path traversal, though practical exploitation…

How to fix or mitigate CVE-2025-25130?

Within 24 hours: Identify all WordPress instances using Delete Comments By Status plugin via security scanning and disable the plugin immediately. Within 7 days: Remove the plugin entirely and replace with alternative comment management functionality if needed; verify no malicious files were introduced during plugin usage. Within 30 days: Monitor vendor (plugin developer) advisory channels for patch availability; once released, test and deploy patched version (currently unavailable as of analysis date).

Delete Comments By Status CVE-2025-25130

HIGH

Relative Path Traversal (CWE-23)

2025-03-03 audit@patchstack.com

PHP Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:19 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.5

DescriptionCVE.org

Relative Path Traversal vulnerability in NotFound Delete Comments By Status allows PHP Local File Inclusion. This issue affects Delete Comments By Status: from n/a through 2.1.1.

AnalysisAI

Path traversal in Delete Comments By Status (WordPress plugin) versions up to 2.1.1 enables remote attackers to include arbitrary PHP files from the local filesystem, potentially achieving remote code execution. Attack requires high complexity (AC:H) and user interaction (UI:R), limiting exploitation to social engineering scenarios. EPSS score of 0.18% (39th percentile) indicates low widespread exploitation probability. No active exploitation confirmed (not in CISA KEV), and no public POC identified at time of analysis.

Technical ContextAI

This is a CWE-23 Relative Path Traversal vulnerability in a WordPress plugin written in PHP. The flaw allows an attacker to manipulate file path inputs using relative path sequences (e.g., '../') to escape intended directory restrictions and include PHP files from arbitrary filesystem locations via PHP's include/require functions (Local File Inclusion). WordPress plugins often handle file operations for admin functions like bulk deletions, and insufficient validation of user-supplied paths can enable attackers to traverse outside the intended webroot. Combined with PHP's dynamic file inclusion capabilities, this creates a code execution risk if attackers can include files containing executable PHP code (uploaded files, log files with injected PHP, or system files like /proc/self/environ).

Affected ProductsAI

Delete Comments By Status WordPress plugin versions from initial release through 2.1.1 are confirmed vulnerable according to NVD data. The CPE would be cpe:2.3:a:notfound:delete_comments_by_status:*:*:*:*:*:wordpress:*:* (versions ≤2.1.1). Vendor advisory available at Patchstack database: https://patchstack.com/database/wordpress/plugin/delete-comments-by-status/vulnerability/wordpress-external-video-for-everybody-plugin-2-1-1-cross-site-scripting-xss-vulnerability-3. Note that Patchstack reference URL contains inconsistent metadata referencing 'external-video-for-everybody' and 'XSS vulnerability' in the slug, which may indicate database cataloging issues - the CVE description clearly identifies this as path traversal in Delete Comments By Status.

RemediationAI

Primary remediation: Upgrade Delete Comments By Status plugin to version 2.1.2 or later if available (check WordPress plugin repository for latest release, as specific fix version is not confirmed in provided data). Vendor has been notified by Patchstack (audit@patchstack.com), suggesting patch coordination likely occurred. If no patched version exists, implement compensating controls: (1) Disable or uninstall Delete Comments By Status plugin entirely until patch is released - this eliminates attack surface but removes comment management functionality. (2) Restrict WordPress admin access to trusted networks only via .htaccess or firewall rules limiting /wp-admin/ access by IP - this reduces attacker ability to exploit the UI:R requirement but impacts legitimate remote administration. (3) Deploy Web Application Firewall (WAF) rules blocking common path traversal patterns (../, %2e%2e%2f, etc.) in plugin requests - may cause false positives with legitimate admin operations. Monitor WordPress logs for suspicious file access attempts. Consult Patchstack advisory for authoritative remediation guidance: https://patchstack.com/database/wordpress/plugin/delete-comments-by-status/vulnerability/.