CVE-2025-60227: 
WordPress vulnerability analysis and mitigation

CVE-2025-60227 is a Path Traversal (Arbitrary File Deletion) vulnerability in the ThimPress WP Pipes WordPress plugin, classified under CWE-22. It affects all versions of WP Pipes up to and including 1.4.3, allowing unauthenticated remote attackers to delete arbitrary files on the web server. The vulnerability was reported by researcher LVT-tholv2k on June 6, 2025, published by Patchstack on July 6, 2025, and assigned a CVE on October 22, 2025. It carries a CVSS v3.1 base score of 8.6 (High), assigned by Patchstack (Patchstack, Feedly).

The vulnerability is rooted in improper input validation of file path parameters within the WP Pipes plugin (CWE-22), allowing attackers to supply path traversal sequences (e.g., ../) that escape the intended directory boundary. Because no authentication is required and the attack complexity is low, a remote attacker can craft a network request targeting the plugin's file-handling functionality to reference and delete files outside the WordPress installation's designated directories. The scope is marked as "Changed" in the CVSS vector, indicating that the impact extends beyond the vulnerable component itself to the broader server file system. No public proof-of-concept exploit code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the web server, which can result in complete disruption of the WordPress site if core files are removed. The availability impact is rated High, while confidentiality and integrity impacts are rated None in the current CVSS scoring, though arbitrary file deletion can indirectly compromise site integrity by removing critical configuration or application files. In a worst-case scenario, deletion of key WordPress or server files could render the site inoperable, facilitate further attacks (e.g., by removing security plugins or logs), or enable privilege escalation if sensitive configuration files are targeted (Patchstack, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic (Patchstack, Feedly).

• Network: Unusual HTTP requests to WP Pipes plugin endpoints containing path traversal sequences such as ../, %2e%2e%2f, or URL-encoded variants in file path parameters.
• Logs: WordPress or web server access logs showing requests to WP Pipes plugin URLs with suspicious path parameters; unexpected 200 or 500 responses associated with file path manipulation attempts.
• File System: Missing or unexpectedly deleted WordPress core files, plugin files, configuration files (e.g., wp-config.php), or .htaccess; timestamps of file deletions correlating with suspicious web requests.
• Process: Unexpected site errors or outages following suspicious requests, potentially indicating deletion of critical application files.

As of the time of publication, no official patch from ThimPress has been released for WP Pipes beyond version 1.4.3. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is available. Recommended immediate actions include: updating the WP Pipes plugin to any version beyond 1.4.3 if a patched release becomes available; deploying a Web Application Firewall (WAF) with rules to block path traversal patterns; implementing strict file system permissions to limit the impact of file deletion; and monitoring for suspicious file access or deletion activity (Patchstack).

Patchstack, the assigning CNA, classified this vulnerability as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites. The vulnerability was briefly discussed on Bluesky via automated CVE tracking accounts shortly after publication. No significant vendor statements from ThimPress or broader media coverage have been identified (Feedly).