CVE-2025-13972

Description

The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.15.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.

PUBLISHED Reserved 2025-12-03 | Published 2025-12-12 | Updated 2025-12-15 | Assigner Wordfence

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Timeline

Credits

Camilla Flocco finder

References

www.wordfence.com/...-8560-48ca-82df-8b620961d9c6?source=cve

plugins.trac.wordpress.org/...q/tags/3.15.0/src/Download.php

plugins.trac.wordpress.org/...towerhq/trunk/src/Download.php

cve.org (CVE-2025-13972)

nvd.nist.gov (CVE-2025-13972)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.