Arbitrary File Read Vulnerability in WP Editor Plugin for WordPress

CVE-2025-3295

What is CVE-2025-3295?

The WP Editor plugin for WordPress contains a security vulnerability that permits authenticated users with Administrator-level access to read arbitrary files from the server. This flaw exists in all versions of the plugin up to and including version 1.2.9.1, potentially enabling unauthorized access to sensitive information that could compromise the security and privacy of the affected WordPress site.

References