Path Traversal Vulnerability in Yoco Payments Plugin for WordPress
CVE-2025-13801
7.5HIGH
What is CVE-2025-13801?
The Yoco Payments plugin for WordPress is susceptible to a path traversal vulnerability allowing unauthenticated users to access files on the server. This flaw occurs via the 'file' parameter, potentially exposing sensitive information stored in arbitrary files. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their applications.
Affected Version(s)
Yoco Payments 0 <= 3.9.0
References
EPSS Score
64% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
NumeX