CVE-2025-58959: 
WordPress vulnerability analysis and mitigation

CVE-2025-58959 is a Path Traversal (Arbitrary File Deletion) vulnerability in the AmentoTech Taskbot WordPress plugin, affecting versions up to and including 6.4. The flaw allows authenticated attackers with at least Subscriber-level privileges to delete arbitrary files on the server via path traversal sequences. It was reported by researcher 0xd4rk5id3 on August 31, 2025, and published by Patchstack on September 30, 2025, with the CVE assigned on October 22, 2025. The vulnerability carries a CVSS v3.1 base score of 7.7 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and arises from insufficient validation of user-supplied file path inputs within the Taskbot plugin. An authenticated attacker with Subscriber-level access can craft requests containing path traversal sequences (e.g., ../) to reference files outside the intended directory, causing the application to delete arbitrary files on the server. The attack is network-based, requires low privileges, no user interaction, and has a changed scope — meaning the impact extends beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker to delete arbitrary files on the web server, including WordPress core files, configuration files (e.g., wp-config.php), or other critical system files. Deletion of core WordPress files can render the site completely non-functional, resulting in a high availability impact. While the Patchstack CVSS score indicates no direct confidentiality or integrity impact from the file deletion itself, removing configuration files could expose sensitive credentials or enable further attacks such as site reinstallation takeover (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-58959 as of the available data. The EPSS score is approximately 0.021% (0.000210), indicating a low current probability of exploitation in the wild. The vulnerability requires at least Subscriber-level authentication, which limits opportunistic mass exploitation but does not eliminate risk on sites with open registration. No CISA KEV catalog listing has been identified for this CVE (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Taskbot plugin version 6.4 or earlier using tools like WPScan or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/taskbot/readme.txt.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (exploitable if user registration is enabled).
3. Identify vulnerable endpoint: Locate the Taskbot plugin functionality that handles file operations (e.g., file deletion requests tied to task or attachment management features).
4. Craft malicious request: Submit an authenticated HTTP request to the vulnerable endpoint with a path traversal payload in the file parameter (e.g., ../../../../wp-config.php) to reference a file outside the intended directory.
5. Achieve arbitrary file deletion: The server processes the traversal sequence without proper sanitization and deletes the targeted file, potentially breaking the WordPress installation or exposing the site to further compromise (Patchstack).

• Logs: WordPress or web server access logs showing authenticated POST/GET requests to Taskbot plugin endpoints containing ../ or URL-encoded equivalents (%2e%2e%2f, %2e%2e/) in file-related parameters.
• File System: Unexpected absence of critical files such as wp-config.php, WordPress core files, or plugin/theme files; timestamps of file deletions correlating with suspicious request activity.
• Logs: PHP error logs showing file-not-found errors or failed include/require statements for files that previously existed, indicating recent deletion.
• Process/Application: WordPress site returning HTTP 500 errors or white screen of death following suspicious authenticated requests to Taskbot endpoints.

The vendor has released version 6.5 of the Taskbot plugin, which patches this vulnerability. All users should update to version 6.5 or later immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. As an additional precaution, site administrators should disable open user registration if not required, to limit the pool of potential attackers (Patchstack).