Directory Traversal Vulnerability in Restrict File Access Plugin for WordPress

CVE-2025-6070

What is CVE-2025-6070?

The Restrict File Access plugin for WordPress contains a Directory Traversal vulnerability that affects all versions up to and including 1.1.2. This vulnerability is exploited through the output() function, allowing authenticated attackers with Subscriber-level access or higher to access and read the contents of arbitrary files on the server. Such access may expose sensitive information, posing a significant risk to the security of the affected WordPress installations.

References