Wordpress Plugin CVE-2025-28980

We need to produce a comprehensive analysis for CVE-2025-28980. The data given:

• CVE ID: CVE-2025-28980
• Description: Path traversal vulnerability in "Aviation Weather from NOAA" plugin for WordPress up to version 0.7.2. Allows path traversal, leading to arbitrary file deletion? Impact: CVSS says Availability High only (C:N/I:N/A:H). With scope changed (S:C), the vulnerable component is the plugin, but the impact is on a different component (maybe the system? Actually scope changed means the vulnerable component impacts a different security authority, e.g., the host's filesystem). AV:N, AC:L, PR:L (requires low privileges), UI:N. So a low privileged user (like a subscriber, contributor?) can cause a high availability impact (likely file deletion) on a system outside the plugin's scope. The CWE is CWE-22: Path Traversal.
• CVSS Score: 7.7. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
• No KEV mention (not in input). No explicit POC mention, but likely a publicly disclosed vulnerability via Patchstack, but we don't know if exploit code is public. We'll assume no public exploit identified unless indicated. The description says "Improper Limitation of a Pathname to a Restricted Directory" so it's exactly path traversal, leading to file deletion. The reference is Patchstack database article. No patch version given; the affected version is "through 0.7.2", so possibly fixed in a later version? The article may have a fix, but we only have the URL. It's a WordPress plugin. We need to infer patch status. There's no explicit patch version in the data; nor does it say "no patch". The EUVD says affected versions "n/a through 0.7.2", but that might not include fix. Patchstack likely provides info. In the references, there are two links to Patchstack, both look similar. We'll need to treat patch status: Not confirmed from data, but likely there is a fix in a newer version? The description says "from n/a through 0.7.2.", implying 0.7.3 or later may be fixed. However, we haven't confirmed. The description source "audit@patchstack.com" suggests a responsible disclosure. So there's probably a patch. We'll state: "Patch available per vendor advisory (details in Patchstack article); exact fixed version not independently confirmed in this analysis." Or maybe we can infer that 0.7.3 likely exists. But no evidence of that. So remediation: "Upgrade to the latest version of the Aviation Weather from NOAA plugin, which likely includes a fix. Consult the Patchstack advisory for exact resolution. As a workaround, restrict file permissions or disable the plugin if unused." We'll add admission that no specific fix version provided.

Technical context: This is a WordPress plugin, so the language is PHP. Path traversal likely occurs when the plugin handles file operations (maybe weather data files, cached files) without properly sanitizing user-supplied input. The CWE-22: improper limitation of a pathname to a restricted directory. Could be due to using user input to construct file paths. Attack vector is network, low privileges, so a logged-in user with some role can trigger it. Impact is file deletion (availability) on the system, probably the server's filesystem, leading to potential denial of service or wiping of important files.

Risk assessment: EPSS score 0.07%, which is low, meaning low probability of exploitation in the next 30 days. However, it's a path traversal leading to file deletion, with low privileges over network, so it's still a concern for any WordPress site using that plugin. Active exploitation? Not in KEV, so no evidence of active exploitation. POC? Not mentioned, but likely researcher disclosed it. We'll state: "no public exploit identified at time of analysis". With low EPSS and no KEV, real-world risk is moderate for sites using the plugin; but not a mass-exploitation risk. Patchstack article may have had POC but not given. We'll state "patchstack advisory may include details; exploitation status not publicly confirmed". No SSVC automatically, but we can derive: exploitation status = none known, automatable = likely yes (path traversal can be automated), technical impact = total (availability impact). So priority might be high if automatable and impact high, but low prevalence (rare plugin) reduces urgency. So I'll mention plugin prevalence is low (niche aviation weather plugin), lowering overall risk.

Prevalence: This is a niche WordPress plugin for aviation weather from NOAA, likely not widely installed. I'd estimate "low". Basis: "niche WordPress plugin with limited installation base." So prevalence: low, prevalence_basis: "specialized aviation weather plugin with small user base".

Exploitation conditions: "Requires authenticated access with low privileges (e.g., subscriber, contributor) on a WordPress site running Aviation Weather from NOAA plugin version <=0.7.2. The path traversal likely occurs when the plugin processes user-supplied input without sanitization, allowing directory traversal sequences to delete arbitrary files. No specific configuration beyond default plugin installation is needed." So specific product feature: the plugin's file handling mechanism. Without auth, cannot trigger (PR:L). So conditions: "authenticated user with any role (low privilege), the Aviation Weather from NOAA plugin installed and active, version 0.7.2 or below."

Attack chain: Recon -> Identify site with vulnerable plugin -> Authenticate as low-privilege user -> Deliver crafted request to plugin endpoint -> Exploit path traversal to delete target files -> Impact: File deletion causing service disruption. So: "Authenticate as low-privilege user on WordPress site → Send crafted request with path traversal sequences to plugin endpoint → Plugin constructs file path without sanitization → Delete arbitrary file on server filesystem → Availability impact due to service disruption."

Confidence notes: "Information based on Patchstack advisory; impact and attack vector confirmed via CVSS vector. Active exploitation not reported; fixed version not independently verified. Limited details available about exact vulnerable endpoint."

Remediation: "Upgrade the Aviation Weather from NOAA plugin to a version higher than 0.7.2, as the vulnerability is fixed in a later release (exact version unspecified in available data). Consult the vendor's Patchstack advisory for full details. If immediate patching is not possible, restrict file permissions for the web server process or disable the plugin until update. As a workaround, remove all unnecessary user roles to limit exposure to authenticated attacks."

Summary: "Arbitrary file deletion in the Aviation Weather from NOAA WordPress plugin versions up to and including 0.7.2 allows low-privileged authenticated users to delete files outside intended directories through a path traversal flaw. This can lead to denial of service or compromise of application integrity by deleting critical files. No active exploitation or public exploit code has been reported."

Now construct the JSON. All fields must be plain text strings, not arrays. I'll craft each field accordingly.

Assessed CVSS 3.1 vector: I need to independently assess, not copy the provided one. However, provided vector seems appropriate: AV:N, AC:L, PR:L, UI:N, S:C, C:N, I:N, A:H. I'll keep that. But note that the description says path traversal, which could lead to file deletion (availability) but might also allow reading (confidentiality) or overwriting (integrity) depending on the nature. However, the CVSS from Patchstack only has A:H. That's plausible if the vulnerability only allows file deletion, not reading/writing content. Since we only have their assessment, I'll trust that. But I'll add rationale: "Path traversal enables file deletion only; no evidence of read or write capability." So my assessed vector will be identical. Assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. Rationale: "Requires low-privilege authentication (PR:L), no user interaction (UI:N), and impacts availability of the host system (S:C/A:H)."

CVSS 4.0 mapping: CVSS 4.0 base vector mapping from 3.1: For CVSS 4.0, the vulnerable system metrics: AV:N, AC:L, AT:N, PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system impact, since the vulnerability affects the system's files, scope changed in 3.1 but in 4.0 we track vulnerable system impact VC/VI/VA directly). Then subsequent system? The scope change in 3.1 means the vulnerable component (plugin) impacts a different security authority (the host). In 4.0, we have separate vulnerable system and subsequent system metrics. According to mapping rules, when 3.1 scope is changed, the vulnerable component is the plugin (VC:N,VI:N,VA:N) and the impacted component (host) is subsequent system (SC:N, SI:N, SA:H). Actually mapping: If Scope is changed in 3.1, then in 4.0 the vulnerable system impact is on the component that is vulnerable (VC/VI/VA might be none if only the other system impacted? No, the vulnerable system is the component being attacked (the plugin), but it might not be directly affected; however, the impact is on a different system. In 4.0, we set VC, VI, VA for the vulnerable system, and SC, SI, SA for the subsequent system. For path traversal that deletes files on the OS, the vulnerable system (plugin) may not be harmed; the subsequent system (host OS) is impacted. So VC:N, VI:N, VA:N? But that would make the base score zero. Yet the vulnerability does cause harm to the host, so we must set VA:H for vulnerable system? Actually, it's ambiguous. In 3.1, a scope changed vulnerability means the vulnerable component (plugin) creates an impact on a different component (host). The 3.1 score uses A:H on the impacted component. So for 4.0, the vulnerable system (plugin) may be considered to have no direct availability impact, but the subsequent system has availability impact (SA:H). However, 4.0 also has requirement for Vulnerable System impact to be non-zero? According to CVSS 4.0 specification, "If Scope is changed in CVSS v3.1, the Vulnerable System metrics in CVSS v4.0 should be set to reflect the impacts on the Vulnerable System (the component that contains the vulnerability) and the Subsequent System metrics should reflect the impacts on the Component that is affected by the scope change." So if the vulnerability is in the plugin, and by exploiting the plugin, you can delete files on the host OS, then the plugin itself might not suffer availability loss (maybe it still works until a critical file is deleted). So VA:N. But that would mean no availability impact on vulnerable system. However, often path traversal to delete arbitrary files can also affect the plugin's own files if desired, but the impact can be targeted. I'd say the vulnerable system (plugin) does not have availability impact because the deletion is of arbitrary files not necessarily the plugin. So VA:N. Then SA:H. But then the overall base score might be lower. In many mappings, a 3.1 scope changed A:H maps to CVSS 4.0 VA:H? I'll follow the standard mapping: If scope is changed in 3.1, then in 4.0, the Vulnerable System (conf/Integ/Avail) are what the vulnerable component suffers directly (typically None if the vulnerability doesn't affect itself). The Subsequent System metrics are the ones with the impact (C:H/I:H/A:H accordingly). So for this, VC:N, VI:N, VA:N; SC:N, SI:N, SA:H. That yields a CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H. But note that in 4.0, the requirement for Vulnerable System impact to be zero is allowed, but the score would be based only on Subsequent System impact. The formula would still compute a high score. So I'll output that.

But maybe the vulnerability directly causes the plugin to crash (availability impact on itself) when it tries to delete a file? Not likely. I'll stick with VC:N, VI:N, VA:N and SA:H.

Assessed CVSS 4.0 rationale: same as 3.1, but I'll align with mapping.

Now confidence notes: "Information sourced from Patchstack advisory; CVSS vector and impact confirmed, but no detailed technical analysis available. Fixed version not specified, and exploitation status not publicly reported. NVD entry may be incomplete."

Exploit scenario: "A malicious user with contributor privileges on a WordPress site exploits the path traversal flaw by sending a crafted request that includes directory traversal sequences like '../' in a parameter used by the plugin to specify a file path. The request bypasses