Arbitrary File Read Vulnerability in Thim Blocks Page Builder for WordPress

CVE-2025-13725

What is CVE-2025-13725?

The Thim Blocks – Page Builder for WordPress is susceptible to arbitrary file read vulnerabilities across all versions up to and including 1.0.1. This weakness arises from inadequate path validation within the server-side rendering process of the icon block. Authenticated attackers with at least Contributor-level access can exploit this vulnerability by manipulating the 'iconSVG' parameter to access sensitive files on the server, including configuration files such as wp-config.php, potentially exposing critical information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References