Directory Traversal Vulnerability in Restrict File Access Plugin for WordPress
CVE-2025-6070
6.5MEDIUM
What is CVE-2025-6070?
The Restrict File Access plugin for WordPress contains a Directory Traversal vulnerability that affects all versions up to and including 1.1.2. This vulnerability is exploited through the output() function, allowing authenticated attackers with Subscriber-level access or higher to access and read the contents of arbitrary files on the server. Such access may expose sensitive information, posing a significant risk to the security of the affected WordPress installations.
Affected Version(s)
Restrict File Access * <= 1.1.2
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Johannes Skamletz