Arbitrary File Deletion Vulnerability in Database Toolset Plugin by WordPress

CVE-2025-3065

What is CVE-2025-3065?

The Database Toolset plugin for WordPress exhibits a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This flaw arises from inadequate file path validation in key functions, particularly affecting all versions up to and including 1.8.4. By exploiting this weakness, attackers can target crucial files, such as wp-config.php, potentially leading to further security breaches, including remote code execution.

References