Wordpress Plugin CVE-2025-66074

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-12-18 audit@patchstack.com

WordPress Path Traversal File Upload Wordpress Plugin

9.0

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

2

Analysis Generated

Jul 26, 2026 - 16:36 vuln.today

CVE Published

Dec 18, 2025 - 08:16 cve.org

CRITICAL 9.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.

AnalysisAI

Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.

More in Wordpress Plugin

View all

CVE-2023-6553 CRITICAL Act Now POC

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL Emergency POC

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL Act Now POC

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-27007 CRITICAL Emergency POC

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL Emergency POC

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-4295 CRITICAL Act Now POC

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

CVE-2024-50498 CRITICAL Emergency POC

Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2024-50623 CRITICAL POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2018-9206 CRITICAL POC

CVE-2024-5084 CRITICAL POC

Same technique Path Traversal

View all

CVE-2019-19781 CRITICAL POC

CVE-2021-21972 CRITICAL POC

CVE-2021-40444 HIGH POC

CVE-2022-41352 CRITICAL POC

CVE-2021-27065 HIGH POC

CVE-2018-20250 HIGH POC

CVE-2022-37042 CRITICAL POC

CVE-2025-64446 CRITICAL POC

Share

CVE-2025-66074 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy