CVE-2025-13070: 
WordPress vulnerability analysis and mitigation

CVE-2025-13070 is a Local File Inclusion (LFI) vulnerability in the CSV to SortTable WordPress plugin affecting all versions through 4.2. The plugin fails to validate shortcode attributes before using them to generate file paths passed to PHP include functions, enabling authenticated users with at least Contributor-level access to include arbitrary files. It was publicly disclosed on November 18, 2025, and assigned a CVSS v3.1 base score of 6.6 (Medium) (WPScan, Red Hat CVE).

The root cause is improper input validation (CWE-22: Path Traversal) of shortcode attributes within the CSV to SortTable plugin. Specifically, the src attribute of the [csv] shortcode is passed directly to a PHP include function without sanitization or path restriction, allowing an attacker to supply an arbitrary file path. Exploitation requires network access and an authenticated session with at minimum Contributor privileges. A proof-of-concept is publicly documented: placing a PHP file (e.g., malicious.php) in the WordPress root and referencing it via [csv src=/malicious.php] in a post preview causes the file to be included and executed (WPScan).

Successful exploitation allows an authenticated Contributor-level user to include and execute arbitrary PHP files accessible on the server's filesystem, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive configuration files (e.g., wp-config.php), execute malicious PHP code for remote code execution, or disrupt site availability. The scope is limited to the affected WordPress instance, but successful exploitation could facilitate lateral movement within the hosting environment (WPScan, Red Hat CVE).

A public proof-of-concept is available via WPScan, lowering the barrier to exploitation. The EPSS score is approximately 0.026% (0.000260), indicating low but non-zero probability of exploitation in the wild. No CISA KEV catalog listing or confirmed in-the-wild exploitation has been reported. Exploitation requires an authenticated account with at least Contributor privileges, which somewhat limits opportunistic attacks but remains a realistic threat on multi-user WordPress sites (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the CSV to SortTable plugin (version ≤ 4.2) using tools like WPScan or by checking plugin directories at /wp-content/plugins/csv-to-sorttable/.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Stage a malicious file: Upload or confirm the existence of a PHP file on the server's filesystem (e.g., a web shell at the WordPress root as malicious.php with content like <?php system($_GET['cmd']); ?>).
4. Craft the malicious shortcode: In a new post or page, insert the shortcode [csv src=/malicious.php] referencing the target file path.
5. Trigger inclusion: Use the WordPress post preview feature to render the shortcode, causing the plugin to pass the unsanitized src value to PHP's include function, executing the referenced file.
6. Achieve objective: Interact with the executed payload (e.g., via query parameters for a web shell) to read sensitive files, execute commands, or establish persistence (WPScan).

• Logs: WordPress access logs showing POST or GET requests to post preview endpoints (/?p=<id>&preview=true) from Contributor-level accounts containing shortcode parameters referencing unusual file paths.
• File System: Presence of unexpected PHP files (e.g., web shells) in the WordPress root or plugin directories; recently modified files in the WordPress installation outside of normal update activity.
• Logs: PHP error logs or WordPress debug logs showing include() calls with paths outside the expected plugin or theme directories.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, php-fpm) such as bash, curl, or wget following shortcode rendering events.

As of the disclosure date (November 18, 2025), there is no known fix for the CSV to SortTable plugin (WPScan). Recommended actions include: (1) immediately deactivating and removing the CSV to SortTable plugin from all WordPress installations; (2) restricting Contributor-level user registration on sites where it is not required; (3) implementing a Web Application Firewall (WAF) rule to block shortcode-based path traversal patterns; and (4) auditing the filesystem for unexpected PHP files that may have been placed for inclusion.

The vulnerability was discovered and reported by researcher Ivan Cese and verified by WPScan upon publication on November 18, 2025. It was subsequently indexed by multiple vulnerability tracking platforms including Vulners, CIRCL, and ENISA's EUVD. No significant vendor statements, major media coverage, or notable community debate has been observed beyond standard vulnerability database indexing (WPScan).