CVE-2025-15487: 
WordPress vulnerability analysis and mitigation

CVE-2025-15487 is a Path Traversal vulnerability in the Code Explorer plugin for WordPress, affecting all versions up to and including 1.4.6. The flaw exists in the file parameter and allows authenticated attackers with Administrator-level access to read arbitrary files on the server. It was published on February 4, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The flaw resides in the plugin's admin class (admin/class-code-explorer-admin.php, line 211), where the file parameter is not properly sanitized or restricted before being used in file system operations. An authenticated administrator can supply a crafted file parameter value containing directory traversal sequences (e.g., ../../) to read files outside the intended directory, such as configuration files containing credentials or other sensitive server data (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator to read the contents of arbitrary files on the web server, including sensitive files such as wp-config.php (containing database credentials), system configuration files, or private keys. The impact is limited to confidentiality — there is no integrity or availability impact. While exploitation requires Administrator-level credentials, the exposure of database credentials or other secrets could facilitate further lateral movement or privilege escalation within the environment (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for Administrator-level authentication, significantly limiting the attacker pool (Wordfence).

1. Authentication: Log in to the WordPress admin panel with an account that has Administrator-level privileges or higher.
2. Identify the vulnerable parameter: Navigate to the Code Explorer plugin's admin interface, which uses the file parameter to load and display file contents.
3. Craft a traversal payload: Modify the file parameter in the HTTP request to include path traversal sequences, e.g., file=../../../../etc/passwd or file=../../../../wp-config.php.
4. Send the request: Submit the crafted request to the vulnerable endpoint in admin/class-code-explorer-admin.php.
5. Read sensitive file contents: The server returns the contents of the targeted file, potentially exposing credentials, configuration data, or other sensitive information (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing admin-area requests to the Code Explorer plugin endpoint with file parameter values containing ../ or URL-encoded traversal sequences (e.g., %2e%2e%2f).
• Logs: Requests to wp-admin pages associated with the Code Explorer plugin that reference files outside the WordPress installation directory (e.g., /etc/passwd, /etc/shadow, wp-config.php from an unexpected path).
• Network: Unusual HTTP GET or POST requests from admin sessions targeting the Code Explorer admin handler with anomalous file parameter values.

Users should update the Code Explorer plugin to version 1.4.7 or later, which addresses the path traversal vulnerability. No configuration-based workaround is available; upgrading is the recommended and only reliable remediation. As an interim measure, administrators can deactivate or remove the Code Explorer plugin until the update can be applied (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on February 4, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified. Community reaction has been minimal, consistent with the Medium severity rating and the high privilege requirement for exploitation.