What is the CVSS score of CVE-2025-60242?

CVE-2025-60242 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Anatoly Download Counter are affected by CVE-2025-60242?

CVE-2025-60242 is a path traversal vulnerability in the Download Counter WordPress plugin (versions ≤1.4) that allows unauthenticated attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2025-60242?

Within 24 hours: Identify all WordPress installations running Download Counter plugin ≤v1.4 via plugin directory audit; disable or deactivate the plugin immediately pending remediation. Within 7 days: contact plugin vendor (Patchstack) for patch status and timeline; evaluate alternative file download plugins without known vulnerabilities. Within 30 days: either apply vendor patch once released to version 1.5 or later, or implement permanent replacement plugin with equivalent functionality.

Anatoly Download Counter CVE-2025-60242

HIGH

Path Traversal (CWE-22)

2025-11-06 audit@patchstack.com

Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:27 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 24, 2026 - 00:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through <= 1.4.

AnalysisAI

Path traversal in Download Counter WordPress plugin through version 1.4 allows unauthenticated remote attackers to read arbitrary files from the web server. The vulnerability enables confidentiality breach through directory traversal sequences. EPSS score of 0.09% indicates low observed exploitation probability. No active exploitation confirmed via CISA KEV, though Patchstack database listing suggests security researcher awareness and potential for weaponization.