Wp Pipes EUVD-2025-17537

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) indicates high real-world risk: the attack is network-accessible, requires no authentication or user interaction, and has low complexity. While confidentiality and integrity impacts are absent (C:N/I:N), the high availability impact (A:H) combined with scope change (S:C) suggests the vulnerability can impact system availability beyond the vulnerable component. The absence of reported EPSS data or KEV/CISA ICS-CERT status from the provided information prevents full exploitation probability assessment, but the straightforward nature of path traversal attacks and lack of authentication requirements suggest this has moderate-to-high exploitability. The vulnerability warrants immediate patching despite the absence of active exploitation signals, as path traversal is a well-understood attack vector with readily available exploitation techniques.

An unauthenticated attacker sends a crafted HTTP request to a WP Pipes plugin endpoint (e.g., http://vulnerable-site.com/wp-content/plugins/wp-pipes/process.php?file=../../../../etc/passwd) containing path traversal sequences. The plugin fails to validate the 'file' parameter and constructs a file path that escapes the intended plugin directory. The attacker can: (1) read sensitive files like wp-config.php to extract database credentials, (2) trigger resource exhaustion by repeatedly accessing large files or directories, causing denial of service, or (3) in some configurations, write files using path traversal in file upload functionality. Given the network-accessible attack vector and absence of authentication, an attacker requires only network access and knowledge of the plugin's parameter names—no special tools or user interaction required. If publicly disclosed proof-of-concept code exists, exploitation risk escalates significantly.