Path Traversal Vulnerability in RSFirewall! Plugin for WordPress
CVE-2025-7518

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Rsfirewall!
Vendor
CVE Published:
12 July 2025

What is CVE-2025-7518?

The RSFirewall! plugin for WordPress is susceptible to a Path Traversal vulnerability. This flaw arises from the get_local_filename() function, allowing attackers with Administrator-level access and above to potentially access and read arbitrary files on the server. Such unauthorized access could lead to the exposure of sensitive data, putting users at risk. It is crucial for site administrators to address this issue to safeguard their systems and data integrity.

Affected Version(s)

RSFirewall! * <= 1.1.42

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robert Kruczek
Kamil Szczurowski
.
CVE-2025-7518 : Path Traversal Vulnerability in RSFirewall! Plugin for WordPress