CVE-2025-13681Disclosure

LOWCVSS 4.9 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files and directories outside the intended `/wp-content/plugins/` directory, which can contain sensitive information such as wp-config.php.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

CVE@CVEnew237d
Disclosure
CVE-2025-13681 The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input v… https://www.cve.org/CVERecord?id=CVE-2025-13681
Post summary
The BFG Tools – Extension Zipper plugin for WordPress (v1.0.7 and earlier) suffers a Path Traversal vulnerability (CVE-2025-13681); no PoC, exploit, patch, or active exploitation details are provided.
00010297
56.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds236d
Disclosure
CVE-2025-13681 Path Traversal in BFG Tools WordPress Extension Zipper Plugin Before 1.0.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-13681
Post summary
The text announces a path traversal vulnerability affecting BFG Tools WordPress Extension Zipper Plugin versions before 1.0.8, without providing PoC, exploit, or patch details.
0000032
4.0K followersView on X
CVEarity@CVEarity237d
Disclosure
⚡ New CVE Alert: CVE-2025-13681 📊 Severity: 4.9 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-13681 #CVE-2025-13681 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/8Mv3i8K0Wd
Post summary
A new medium‑severity CVE-2025-13681 affecting WordPress is announced with basic severity information, but no exploitation, patch, or technical detail is disclosed.
0000060
57 followersView on X

Explore more

Back to dashboard