Path Traversal Vulnerability in ThimPress WP Pipes Plugin
CVE-2025-60227

8.6HIGH

Key Information:

Vendor

WordPress
Status
WP Pipes
Vendor
CVE Published:
22 October 2025

What is CVE-2025-60227?

The ThimPress WP Pipes plugin has a vulnerability that allows attackers to exploit improper limitations on a pathname, leading to potential unauthorized access to files within restricted directories. This issue affects all versions of WP Pipes up to and including 1.4.3. By leveraging this vulnerability, attackers can manipulate paths to gain access to sensitive information stored within the server, posing a significant security risk.

Affected Version(s)

WP Pipes <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/wp-p...
vdb-entry

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
JSON
.