CVE-2025-13801: 
WordPress vulnerability analysis and mitigation

CVE-2025-13801 is a Path Traversal vulnerability in the Yoco Payments plugin for WordPress, classified under CWE-22. It affects all versions up to and including 3.9.0 (initially disclosed as affecting up to 3.8.8, later updated on April 8, 2026 to include 3.9.0). The flaw allows unauthenticated remote attackers to read arbitrary files on the server via the file parameter. It was first published on January 7, 2026, by Wordfence, and carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, NVD).

The vulnerability is rooted in improper input validation of the file parameter within the plugin's log-handling code, specifically in src/Helpers/Logs.php (lines 25 and 59 of version 3.8.8). An attacker can supply path traversal sequences (e.g., ../../) in the file parameter to escape the intended directory and access arbitrary files on the server's filesystem without any authentication. This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository in June 2026, indicating the vulnerability is well-characterized for automated scanning (Wordfence, Plugin Source).

Successful exploitation allows unauthenticated attackers to read the contents of arbitrary files on the web server, including sensitive configuration files such as WordPress wp-config.php (which contains database credentials), environment files, and other server-side secrets. This results in a high confidentiality impact with no integrity or availability impact. Exposed credentials could enable further attacks such as database access, lateral movement within the hosting environment, or full site takeover (Wordfence, NVD).

The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable over the network. The EPSS score is approximately 0.167%, indicating a relatively low but non-negligible probability of exploitation in the wild. A Nuclei template for automated detection was committed to the ProjectDiscovery nuclei-templates repository in June 2026 (v10.4.3 release), lowering the barrier for mass scanning. No confirmed in-the-wild exploitation or CISA KEV listing has been reported as of the available data (Wordfence, Nuclei Templates).

1. Reconnaissance: Identify WordPress sites running the Yoco Payments plugin (versions ≤ 3.9.0) using tools like WPScan, Shodan, or the Nuclei template added in June 2026.
2. Identify vulnerable endpoint: Locate the plugin's log-viewing functionality, which exposes a file parameter that is passed unsanitized to a file-reading function in src/Helpers/Logs.php.
3. Craft path traversal payload: Construct an HTTP request with a file parameter containing traversal sequences, e.g., file=../../../../wp-config.php or file=../../../../etc/passwd.
4. Send unauthenticated request: Submit the crafted request to the vulnerable endpoint without any authentication headers or cookies.
5. Retrieve sensitive data: Parse the server's response to extract the contents of the targeted file, such as database credentials from wp-config.php, which can be used for further compromise (Wordfence, Plugin Source).

• Network: Unusual HTTP GET or POST requests to the Yoco Payments plugin endpoint containing file= parameters with path traversal sequences (e.g., ../, %2e%2e%2f, ..%2f) in web server access logs.
• Logs: WordPress or web server access logs showing requests to plugin-related URLs (e.g., /wp-admin/admin-ajax.php or plugin-specific endpoints) with encoded traversal strings and HTTP 200 responses returning unexpected content lengths.
• File System: No direct file system artifacts expected from a read-only path traversal; however, monitor for subsequent unauthorized access to the database or admin panel if credentials were exposed via wp-config.php.
• Process/Behavior: Unexpected database login attempts from new IP addresses following exploitation attempts, potentially indicating credential harvesting from exposed configuration files.

Users should update the Yoco Payments plugin to version 3.8.9 or later (the patch was introduced in changeset 3434947 on the WordPress plugin repository). The fix restricts the file parameter to prevent directory traversal outside the intended log directory. No configuration-based workaround is documented; upgrading is the only recommended remediation. Site administrators should also audit web server logs for prior exploitation attempts and rotate any credentials that may have been exposed (Wordfence, Plugin Changeset).

Wordfence included CVE-2025-13801 in their weekly WordPress vulnerability report for January 5–11, 2026, noting it as a notable unauthenticated file read issue. The vulnerability received brief social media attention from security accounts on Bluesky, Mastodon, and X (via RedPacketSecurity), primarily as an automated CVE alert rather than in-depth analysis. The addition of a Nuclei detection template in June 2026 by ProjectDiscovery indicates ongoing community interest in automated detection (Wordfence Blog, Nuclei Templates).