What is the CVSS score of CVE-2025-69379?

CVE-2025-69379 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-69379?

A critical path traversal vulnerability in the Upload Files Anywhere WordPress plugin (versions ≤2.8) allows attackers to access and potentially modify files outside intended directories, exposing…

How to fix or mitigate CVE-2025-69379?

Within 24 hours: Identify all WordPress instances using Upload Files Anywhere plugin and document current version numbers; disable the plugin immediately as a temporary measure. Within 7 days: Contact the plugin vendor for patched version availability and develop a deployment plan; implement Web Application Firewall rules to block path traversal attempts (../sequences). Within 30 days: Deploy patched plugin version upon vendor release; conduct security audit of file upload directories for evidence of unauthorized access; implement file upload restrictions and proper access controls.

PHP CVE-2025-69379

HIGH

Path Traversal (CWE-22)

2026-02-20 audit@patchstack.com

WordPress Path Traversal PHP

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 16:22 nvd

HIGH 8.6

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.

AnalysisAI

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects vanquish Upload Files Anywhere wp-upload-files-anywhere. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.

Affected ProductsAI

Product: vanquish Upload Files Anywhere wp-upload-files-anywhere.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.