vulnerability
WordPress Plugin: simple-csv-table: CVE-2025-12960: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:S/C:C/I:N/A:N) | Dec 11, 2025 | Dec 12, 2025 | Dec 15, 2025 |
Severity
7
CVSS
(AV:N/AC:L/Au:S/C:C/I:N/A:N)
Published
Dec 11, 2025
Added
Dec 12, 2025
Modified
Dec 15, 2025
Description
The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[csv]` shortcode. This is due to insufficient path validation before concatenating user-supplied input to a base directory path. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Solution
simple-csv-table-plugin-cve-2025-12960
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.