CVE-2025-60242: 
WordPress vulnerability analysis and mitigation

CVE-2025-60242 is a Path Traversal (Arbitrary File Download) vulnerability in the WordPress Download Counter plugin by Anatoly, affecting all versions up to and including 1.4. The flaw allows unauthenticated remote attackers to download arbitrary files from the server's filesystem. It was reported by researcher 0xd4rk5id3 on May 23, 2025, and published by Patchstack on June 22, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The plugin fails to properly sanitize or restrict file path inputs used in download requests, allowing an attacker to supply directory traversal sequences (e.g., ../) to escape the intended download directory and access arbitrary files on the web server. No authentication or special privileges are required, and exploitation is straightforward over the network with low attack complexity. No public PoC code has been identified at this time, though Patchstack notes vulnerabilities of this class are commonly used in mass-exploit campaigns (Patchstack).

Successful exploitation allows an unauthenticated attacker to download any file readable by the web server process, including sensitive configuration files (e.g., wp-config.php containing database credentials), backup archives, private keys, or other data stored on the server. This results in a high confidentiality impact with no integrity or availability impact. Exposed credentials could enable further compromise such as database access, administrative account takeover, or lateral movement within the hosting environment (Patchstack).

No official patch is currently available for the Download Counter plugin. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts. The EPSS score is approximately 0.027%, indicating a currently low but non-negligible probability of exploitation in the near term. Patchstack classifies this as high priority and warns that vulnerabilities of this type are frequently leveraged in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic. There is no confirmed in-the-wild exploitation or CISA KEV listing at this time (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Download Counter plugin (version ≤ 1.4) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths (e.g., inurl:/wp-content/plugins/download-counter/).
2. Identify vulnerable endpoint: Locate the plugin's file download handler — typically a PHP script or URL parameter that accepts a filename or path for download.
3. Craft traversal payload: Construct an HTTP request with a path traversal sequence in the file parameter, such as ?file=../../../../wp-config.php or URL-encoded equivalents (%2e%2e%2f).
4. Send request: Submit the crafted GET or POST request to the vulnerable endpoint without any authentication.
5. Retrieve sensitive file: The server responds with the contents of the targeted file (e.g., wp-config.php), exposing database credentials, secret keys, or other sensitive data that can be used for further compromise (Patchstack).

• Network: Unusual HTTP GET/POST requests to the Download Counter plugin endpoint containing ../, %2e%2e%2f, or other traversal sequences in file parameters; requests returning large or unexpected file content (e.g., PHP source files).
• Logs: Web server access logs (Apache/Nginx) showing requests to /wp-content/plugins/download-counter/ with traversal patterns in query strings; HTTP 200 responses to requests for non-download files such as wp-config.php.
• File System: No direct file system artifacts expected from read-only exploitation, but subsequent attacker actions using harvested credentials may result in new admin accounts, modified files, or installed backdoors in the WordPress installation directory.

There is currently no official patch available from the plugin developer for Download Counter ≤ 1.4. The primary recommended actions are:

• Remove or deactivate the Download Counter plugin until an official patch is released.
• Apply Patchstack virtual patching: Patchstack has issued a mitigation rule that blocks exploitation attempts for subscribers.
• Restrict web server permissions: Ensure the web server process runs with least-privilege file system access to limit the scope of any traversal attack.
• Monitor logs: Review web server access logs for traversal patterns targeting the plugin's endpoints (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher 0xd4rk5id3, classifies it as high priority and warns of its potential use in mass-exploit campaigns. No significant vendor response, researcher commentary beyond the Patchstack advisory, or notable media coverage has been identified at this time (Patchstack).