CVE-2025-28980: 
WordPress vulnerability analysis and mitigation

CVE-2025-28980 is a Path Traversal vulnerability (CWE-22) in the Aviation Weather from NOAA WordPress plugin, developed by machouinard. The flaw allows authenticated attackers to perform arbitrary file deletion on the server by manipulating file path inputs. All versions up to and including 0.7.2 are affected. The vulnerability was published on July 4, 2025, and carries a CVSS v3.1 base score of 7.7 (High) (Red Hat CVE, Patchstack).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22), where user-supplied input is used in file system operations without adequate sanitization or path canonicalization. An authenticated attacker with low privileges can craft a request containing path traversal sequences (e.g., ../) to escape the intended directory boundary and reference arbitrary files on the server. The vulnerability has a changed scope, meaning its impact extends beyond the plugin's own context to affect the broader WordPress installation or underlying server. No public proof-of-concept code has been identified at this time (Red Hat CVE, Patchstack).

Successful exploitation results in arbitrary file deletion on the host server, with a high availability impact and a changed scope that can affect resources beyond the vulnerable plugin itself. An attacker could delete critical WordPress core files, configuration files (e.g., wp-config.php), or other sensitive server files, potentially causing complete site outage or enabling further attacks (such as forcing a WordPress reinstallation to hijack the site). Confidentiality and integrity are not directly impacted according to the CVSS scoring, but the availability impact is rated High (Red Hat CVE).

Exploitation requires a low level of authentication (any registered WordPress user) and no user interaction, with low attack complexity over the network. There is no evidence of active in-the-wild exploitation or inclusion in the CISA KEV catalog at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. No exploit kits or weaponized code have been publicly reported (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Aviation Weather from NOAA plugin (version ≤ 0.7.2) using tools like WPScan or by checking /wp-content/plugins/aviation-weather-from-noaa/ for plugin presence.
2. Obtain low-privilege access: Register or log in as any authenticated WordPress user (subscriber-level or above).
3. Identify vulnerable parameter: Locate the plugin functionality that accepts a file path or filename parameter in a request (e.g., a form submission or AJAX action handled by the plugin).
4. Craft path traversal payload: Inject a traversal sequence such as ../../wp-config.php or ../../../etc/passwd into the file path parameter to escape the plugin's intended directory.
5. Trigger file deletion: Submit the crafted request to the vulnerable endpoint; the plugin processes the unsanitized path and deletes the targeted file on the server.
6. Achieve objective: Deletion of wp-config.php can force a WordPress reinstallation, potentially allowing site takeover, or deletion of other critical files can cause denial of service (Red Hat CVE, Patchstack).

• Logs: WordPress or web server access logs showing requests to plugin-related endpoints (e.g., admin-ajax.php or plugin-specific pages) with parameters containing ../ or URL-encoded traversal sequences (%2e%2e%2f, %2e%2e/).
• File System: Unexpected absence of critical files such as wp-config.php, WordPress core files, or other server files; file system audit logs recording deletions by the web server process (e.g., www-data, apache).
• Logs: PHP error logs showing file operation errors or warnings related to paths outside the WordPress root directory.
• Process: Unusual web server process activity involving file deletion operations in directories outside /wp-content/plugins/aviation-weather-from-noaa/.

The primary remediation is to update the Aviation Weather from NOAA plugin to a version beyond 0.7.2 once a patched release is available from the plugin author (machouinard). If no patch is yet available, administrators should deactivate and remove the plugin until a fix is released. Additionally, restrict WordPress user registrations to trusted individuals to reduce the attack surface, and implement a Web Application Firewall (WAF) rule to block path traversal patterns in HTTP requests (Patchstack, Wordfence).

The vulnerability was reported and assigned by Patchstack, a WordPress security platform, and was included in Wordfence's weekly WordPress vulnerability report for the week of June 30 – July 6, 2025. It was also referenced in CISA's vulnerability bulletin (SB25-188) for the week of June 30, 2025. No significant independent researcher commentary or broader media coverage has been identified (Wordfence, CISA Bulletin).