What is the CVSS score of CVE-2025-9950?

CVE-2025-9950 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-9950

MEDIUM

Path Traversal (CWE-22)

2025-10-11 security@wordfence.com

Path Traversal WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 11, 2025 - 10:15 nvd

MEDIUM 4.9

DescriptionCVE.org

The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_file function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Directory traversal in the Error Log Viewer plugin for WordPress (versions up to 1.1.6) allows authenticated administrators to read arbitrary files on the server via the rrrlgvwr_get_file function. The vulnerability is rooted in insufficient path validation (CWE-22) and has a CVSS score of 4.9 due to high confidentiality impact but limited scope (administrator privilege requirement). No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The Error Log Viewer plugin for WordPress processes file paths through the rrrlgvwr_get_file function without proper sanitization or validation. The vulnerability exploits CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) by allowing directory traversal sequences (such as ../ or absolute paths) to bypass intended directory restrictions. This enables reading of sensitive configuration files (wp-config.php, .env files), system logs, and other sensitive information stored outside the intended log directory. The attack vector is network-based (AV:N) with low complexity (AC:L), but requires high privilege (PR:H) - specifically WordPress Administrator or above - limiting the practical attack surface to insider threats or compromised administrator accounts.

Affected ProductsAI

The Error Log Viewer plugin by BestWebSoft for WordPress is affected in all versions up to and including 1.1.6. The plugin is distributed through the official WordPress Plugin Directory (plugins.trac.wordpress.org/browser/error-log-viewer). WordPress administrators running this plugin on any version 1.1.6 or earlier should prioritize review and remediation.

RemediationAI

Upgrade the Error Log Viewer plugin to a patched version released after 1.1.6. Check the official WordPress Plugin Directory (https://plugins.trac.wordpress.org/browser/error-log-viewer/) and BestWebSoft's plugin page for the latest available version that addresses this directory traversal vulnerability. If an immediate patch is unavailable, consider temporarily disabling the plugin until a fix is released, as the vulnerability requires Administrator access and poses risk primarily to organizations concerned with insider threats or admin account compromise. Review server access logs and file access patterns for any suspicious activity from administrator accounts using this plugin.