Pro Bulk Watermark CVE-2025-28973
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via WordPress HTTP, low complexity, PR:L matches mandatory subscriber-level auth; confidentiality-only impact with no integrity or availability consequences.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through <= 2.0.
AnalysisAI
Path traversal in Pro Bulk Watermark Plugin for WordPress (versions through 2.0) exposes arbitrary server files to authenticated attackers via the '.../...//' obfuscation technique, which bypasses naive path sanitization. The CVSS vector (PR:L) confirms that a low-privileged authenticated user - such as a subscriber or contributor - can exploit this to read sensitive files. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at a very low 0.06%.
Technical ContextAI
CWE-35 describes the '.../...//' path traversal variant, where doubled dots and slashes evade filters that only strip simple '../' sequences - for example, '.../...//' collapses to '../' after naive sanitization. The affected plugin (slug: pro-watermark, vendor: AA-Team) is a PHP-based WordPress plugin that performs bulk image watermarking, a function that inherently involves server-side file path handling. WordPress plugins with image or file manipulation features frequently accept user-supplied paths or filenames that, when not canonicalized and validated against a whitelist base directory, become vectors for traversal attacks. No CPE string was provided; the affected component is wordpress-plugin:pro-watermark versions up to and including 2.0.
Affected ProductsAI
Pro Bulk Watermark Plugin for WordPress by AA-Team is affected in all versions from the beginning of the version history through and including version 2.0. No CPE string was included in the source data. The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/pro-watermark/vulnerability/wordpress-pro-bulk-watermark-plugin-for-wordpress-2-0-path-traversal-vulnerability is the primary reference; no separate vendor advisory from AA-Team was listed.
RemediationAI
Check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/pro-watermark/vulnerability/wordpress-pro-bulk-watermark-plugin-for-wordpress-2-0-path-traversal-vulnerability for a patched release above version 2.0. No exact fixed version is independently confirmed from the available data. If no updated version is available, the most effective compensating control is to deactivate and remove the plugin - disabling the code path entirely. As a secondary measure, restrict WordPress user registration to eliminate the PR:L entry point if subscriber-level accounts are not required. Applying a web application firewall rule to block requests containing '.../...//' or URL-encoded equivalents targeting the plugin's endpoints reduces exposure with minimal operational impact. Note that wp-config.php should be moved above the web root as a general hardening measure to limit the damage of any path traversal.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today