What is the CVSS score of CVE-2025-64235?

CVE-2025-64235 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Tuturn CVE-2025-64235

Q: Which versions of Tuturn are affected by CVE-2025-64235?

Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files.

MEDIUM

Path Traversal (CWE-22)

2025-12-18 audit@patchstack.com

WordPress Path Traversal Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Low-privilege authenticated remote user can read arbitrary files without user interaction; high confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:34 vuln.today

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn tuturn allows Path Traversal.This issue affects Tuturn: from n/a through < 3.6.

AnalysisAI

Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files. No active exploitation or public exploit code has been reported; EPSS exploitation probability is low (0.07%).

Technical ContextAI

The vulnerability is a path traversal (CWE-22) in the Tuturn WordPress plugin, a PHP application. Improper limitation of pathnames to a restricted directory allows an attacker to use sequences like '../' to escape the intended directory and access arbitrary files outside the web root. This is a classic file disclosure weakness caused by insufficient sanitization of user‑supplied path parameters in a plugin endpoint.

Affected ProductsAI

AmentoTech Tuturn plugin for WordPress in all versions prior to 3.6. The vulnerability is documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tuturn/vulnerability/wordpress-tuturn-plugin-3-6-arbitrary-file-download-vulnerability?_s_id=cve.

RemediationAI

Upgrade the Tuturn plugin to version 3.6 or newer immediately. The vendor‑released patch is confirmed in the Patchstack advisory. If an immediate upgrade is not possible, temporarily disable the plugin to eliminate the attack surface, though this will remove the plugin’s tutoring functionality. Restrict access to the plugin’s REST endpoints by blocking direct requests to affected routes via a web application firewall as a short‑term compensating control.