CVE-2025-60217: 
WordPress vulnerability analysis and mitigation

CVE-2025-60217 is a Path Traversal (Arbitrary File Deletion) vulnerability in the PT Luxa Addons WordPress plugin developed by ypromo. It affects all versions up to and including 1.2.2, allowing authenticated attackers with at least Subscriber-level privileges to delete arbitrary files on the server. The vulnerability was reported on May 11, 2025, by researcher Bonds and published by Patchstack on June 10, 2025; it was assigned a CVE on October 22, 2025. It carries a CVSS v3.1 base score of 7.7 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from insufficient validation of user-supplied file path input within the PT Luxa Addons plugin. An authenticated attacker with Subscriber-level access can craft a malicious request containing path traversal sequences (e.g., ../) to reference files outside the intended directory, causing the plugin to delete arbitrary files on the server. No public proof-of-concept code has been identified, but the attack vector is network-accessible, requires low privileges, and no user interaction (Patchstack).

Successful exploitation allows an authenticated attacker to delete arbitrary files from the WordPress server, including critical WordPress core files, configuration files (e.g., wp-config.php), or plugin/theme files. Deletion of core files can render the website completely non-functional, resulting in a high availability impact. While the current CVSS scoring reflects no direct confidentiality or integrity impact, deletion of wp-config.php could indirectly expose database credentials or enable site reinstallation attacks, potentially leading to full site compromise (Patchstack).

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2025-60217. The EPSS score is approximately 0.039%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic (Patchstack).

1. Reconnaissance: Identify WordPress sites running the PT Luxa Addons plugin (version ≤ 1.2.2) using tools like WPScan or Shodan, or by checking the plugin's readme.txt file at wp-content/plugins/pt-luxa-addons/readme.txt.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (e.g., via open registration).
3. Identify vulnerable endpoint: Locate the plugin functionality that accepts a file path parameter, typically an AJAX action or admin-facing endpoint exposed by the plugin.
4. Craft malicious request: Submit an authenticated HTTP request to the vulnerable endpoint with a path traversal payload (e.g., ../../../../wp-config.php) as the file path parameter.
5. Achieve arbitrary file deletion: The plugin processes the traversal sequence without proper sanitization, causing the server to delete the targeted file outside the plugin's intended directory, potentially breaking the site or enabling further compromise (Patchstack).

• Logs: WordPress access logs showing authenticated POST or GET requests to plugin-specific AJAX endpoints (e.g., wp-admin/admin-ajax.php) with parameters containing ../ or URL-encoded traversal sequences (%2e%2e%2f).
• File System: Unexpected disappearance of critical files such as wp-config.php, .htaccess, or core WordPress files; missing plugin or theme files not explained by legitimate updates.
• Logs: PHP error logs showing file deletion errors or warnings referencing paths outside the wp-content/plugins/pt-luxa-addons/ directory.
• Network: Repeated authenticated requests from a single low-privilege user account to plugin endpoints in a short time window, potentially indicating automated exploitation.

As of the time of publication, no official patch is available from the plugin developer for PT Luxa Addons. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts until an official fix is released. Site administrators should immediately deactivate and remove the PT Luxa Addons plugin (versions ≤ 1.2.2) if no patch is available, or contact their hosting provider for assistance. Restricting user registration and minimizing the number of Subscriber-level accounts can reduce the attack surface (Patchstack).