What is the CVSS score of EUVD-2025-19972?

EUVD-2025-19972 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Aviation Weather NOAA are affected by EUVD-2025-19972?

Organizations using the NOAA Aviation Weather WordPress plugin (versions 0.7.2 and earlier) face an immediate availability risk: low-privilege user accounts can exploit a path traversal flaw to…

How to fix or mitigate EUVD-2025-19972?

Within 24 hours: identify all WordPress installations using the Aviation Weather from NOAA plugin and document their versions. If this plugin is not operationally critical, disable it immediately to eliminate risk. Within 7 days: for systems where the plugin is required, restrict user permissions by removing access from contributor and editor roles-allow administrators only. Implement strict file system permissions (644 for files, 755 for directories) and deploy a web application firewall to block directory traversal patterns. Within 30 days: monitor the Patchstack security advisory and the official plugin repository for a vendor-released patch; when available, test and deploy immediately, or migrate to an alternative weather plugin with equivalent functionality.

Aviation Weather NOAA EUVD-2025-19972

| CVE-2025-28980 HIGH

Path Traversal (CWE-22)

2025-07-04 audit@patchstack.com

WordPress Path Traversal Wordpress Plugin

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Network-accessible plugin endpoint, low-privilege auth required, scope change because web process can delete files outside webroot, no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 02:42 euvd

EUVD-2025-19972

Analysis Generated

Mar 16, 2026 - 02:42 vuln.today

CVE Published

Jul 04, 2025 - 12:15 nvd

HIGH 7.7

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA allows Path Traversal. This issue affects Aviation Weather from NOAA: from n/a through 0.7.2.

AnalysisAI

Path traversal leading to arbitrary file deletion in the Aviation Weather from NOAA WordPress plugin (versions through 0.7.2) allows an authenticated attacker to delete files outside the plugin's intended directory scope. The Patchstack advisory confirms the impact is arbitrary file deletion rather than disclosure, consistent with the CVSS vector showing A:H with C:N/I:N. Exploitation requires a low-privilege WordPress account, and no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is a WordPress plugin (aviation-weather-from-noaa) that fetches and displays aviation weather data from NOAA. CWE-22 (Path Traversal) describes the root cause: user-supplied path input is not properly sanitized or constrained to a restricted directory before being used in filesystem operations. In this case the traversal primitive is leveraged for file deletion rather than file read, explaining why the CVSS vector carries C:N but A:H. The S:C (Scope Changed) metric in the CVSS 3.1 vector indicates the web server process can delete files outside the WordPress installation tree, potentially affecting the underlying host OS or other hosted applications. Affected CPE covers the plugin at all versions up to and including 0.7.2.

RemediationAI

Update the Aviation Weather from NOAA plugin to a version above 0.7.2 as the primary remediation. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/aviation-weather-from-noaa/vulnerability/wordpress-aviation-weather-from-noaa-0-7-2-arbitrary-file-deletion-vulnerability provides the canonical fix reference. If an updated plugin version is not yet available in the WordPress plugin repository, the most effective compensating control is to disable user registration or restrict the WordPress roles that can access plugin functionality - specifically preventing untrusted subscriber-level accounts from invoking plugin file-handling endpoints. Additionally, configuring filesystem permissions so the web server process cannot write or delete files outside the webroot reduces the scope of any successful traversal. Monitoring file deletion events on the server via auditd or equivalent provides detection capability in the interim.