CVE-2025-3295

—

CVSS 3.1

4.9 medium

EPSS

<1%p42

Published

Apr 17, 2025 (Apr 17, 2025)

Modified

Jun 17, 2026

Description

The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.

Vendors: benjaminrojas
Products: wp editor
Ecosystems: WordPress
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.