CVE-2025-23422: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability was discovered in the WordPress Store Locator plugin versions 3.98.10 and below. The vulnerability was reported on September 4, 2024, by security researcher tahu.datar and was officially published on January 16, 2025, with the identifier CVE-2025-23422. This unauthenticated vulnerability affects the NotFound Store Locator component (Patchstack).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') issue. It has been assigned a CVSS severity score of 7.5 (High), indicating its significant potential impact. The vulnerability falls under the OWASP Top 10 category A3: Injection (Patchstack).

The vulnerability could allow malicious actors to include and view local files from the target website. This could potentially expose sensitive information, including database credentials, which might lead to a complete database compromise depending on the system configuration (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement mitigation measures immediately (Patchstack).