What is the CVSS score of CVE-2025-69097?

CVE-2025-69097 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of VibeThemes WPLMS are affected by CVE-2025-69097?

A critical path traversal vulnerability in the WPLMS WordPress plugin (versions up to 1.9.9.5.4) could allow attackers to access sensitive files and data outside the intended directory structure.

How to fix or mitigate CVE-2025-69097?

Within 24 hours: Audit all systems running WPLMS plugin and document affected instances; disable the plugin if non-critical or isolate affected WordPress installations from production traffic. Within 7 days: Contact VibeThemes for patch availability and timelines; implement compensating controls listed below and monitor access logs for exploitation attempts. Within 30 days: Apply vendor patch immediately upon release; if no patch is released, evaluate alternative learning management plugins and plan migration timeline.

VibeThemes WPLMS CVE-2025-69097

HIGH

Path Traversal (CWE-22)

2026-01-22 audit@patchstack.com

Path Traversal

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 8.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

AnalysisAI

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects VibeThemes WPLMS wplms_plugin. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

Affected ProductsAI

Product: VibeThemes WPLMS wplms_plugin.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.