CVE-2025-26540: 
WordPress vulnerability analysis and mitigation

The Helloprint WordPress plugin versions through 2.0.7 is affected by a Path Traversal vulnerability (CVE-2025-26540). The vulnerability was discovered and reported by researcher LVT-tholv2k, and was publicly disclosed on February 22, 2025 (Patchstack).

The vulnerability is classified as a Path Traversal issue (CWE-22) that could lead to arbitrary file deletion. It has received a CVSS v3.1 base score of 7.7 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (NVD).

If successfully exploited, this vulnerability could allow an authenticated attacker with Subscriber-level privileges or higher to delete files from the website. The deletion of core files could potentially cause the site to break and stop functioning (Patchstack).

The vulnerability requires authentication with at least Subscriber-level access to exploit. According to security researchers, this vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability has been fixed in version 2.1.0 of the Helloprint plugin. Users are advised to update to version 2.1.0 or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until the update can be applied (Patchstack).