CVE-2025-8009

Description

The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242 via the 'get_file_source' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data, including the contents of any file on the server.

PUBLISHED Reserved 2025-07-21 | Published 2025-07-24 | Updated 2025-07-24 | Assigner Wordfence

Problem types

CWE-36 Absolute Path Traversal

Product status

Timeline

Credits

Jonas Benjamin Friedli finder

References

www.wordfence.com/...-9978-48ec-8f87-229dc82938a8?source=cve

plugins.trac.wordpress.org/.../core-scanner/core-scanner.php

plugins.trac.wordpress.org/.../core-scanner/core-scanner.php

plugins.trac.wordpress.org/changeset/3333048/

cve.org (CVE-2025-8009)

nvd.nist.gov (CVE-2025-8009)

Download JSON