Unauthenticated File Read Vulnerability in PhastPress Plugin for WordPress

CVE-2025-14388

What is CVE-2025-14388?

The PhastPress plugin for WordPress is susceptible to an unauthenticated arbitrary file read vulnerability due to improper null byte handling. This issue allows attackers to read sensitive files from the server by exploiting a flaw in how file paths are validated. Specifically, a double URL-encoded null byte (%2500) can be appended to a file path with an allowed extension, bypassing security measures. Attackers can potentially access critical configuration files like wp-config.php, which could lead to further exploitation of the site.

References