Path Traversal Vulnerability in Aviation Weather Plugin by NOAA
CVE-2025-28980

7.7HIGH

Key Information:

Vendor

WordPress
Status
Aviation Weather From Noaa
Vendor
CVE Published:
4 July 2025

What is CVE-2025-28980?

The Aviation Weather plugin from NOAA is susceptible to a path traversal vulnerability, which could allow an attacker to manipulate file paths and access restricted files on the server. This flaw affects versions from n/a to 0.7.2, potentially enabling unauthorized file deletion or exposure of sensitive information. Website administrators are highly encouraged to update to the latest version and implement appropriate security measures to mitigate this risk.

Affected Version(s)

Aviation Weather from NOAA <= 0.7.2

References

https://patchstack.com/database/wordpress/plugin/aviation...
vdb-entry

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xd4rk5id3 (Patchstack Alliance)
.
CVE-2025-28980 : Path Traversal Vulnerability in Aviation Weather Plugin by NOAA