CVE-2025-67963: 
WordPress vulnerability analysis and mitigation

CVE-2025-67963 is a Path Traversal (Arbitrary File Deletion) vulnerability in the ovatheme Movie Booking WordPress plugin, affecting all versions through 1.1.5. The flaw allows unauthenticated remote attackers to traverse directory structures and delete arbitrary files on the server. It was reported by researcher Phat RiO on November 10, 2025, and published by Patchstack on January 21–22, 2026. A patched version (1.1.6) is available. The vulnerability carries a CVSS v3.1 base score of 8.6 (High), assigned by CISA-ADP (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and manifests as an arbitrary file deletion capability via path traversal. The plugin fails to properly sanitize or validate file path parameters, allowing an attacker to supply directory traversal sequences (e.g., ../../) to reference files outside the intended web root or plugin directory. Because no authentication, elevated privileges, or user interaction is required, exploitation is straightforward over the network with low attack complexity. The CVSS scope is marked as "Changed," indicating that the impact extends beyond the vulnerable component itself — deleted files can affect the broader WordPress installation or underlying server (Patchstack).

Successful exploitation enables an unauthenticated attacker to delete arbitrary files on the web server, including WordPress core files, configuration files (e.g., wp-config.php), or other critical assets. Deletion of core files can render the WordPress site completely non-functional, resulting in a denial-of-service condition. While the CVSS vector indicates no direct confidentiality or integrity impact, deleting wp-config.php could trigger a WordPress reinstallation flow, potentially allowing an attacker to reconfigure the site with attacker-controlled database credentials (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that high-CVSS unauthenticated vulnerabilities of this type are frequently used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the ovatheme Movie Booking plugin version 1.1.5 or earlier using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at wp-content/plugins/movie-booking/readme.txt.
2. Identify vulnerable endpoint: Locate the plugin's file-handling functionality that accepts a file path parameter without proper sanitization — typically a form submission or AJAX action endpoint registered by the plugin.
3. Craft traversal payload: Construct an HTTP request containing a path traversal sequence in the file path parameter, such as ../../../../wp-config.php or ../../../../wp-content/uploads/malicious.php, targeting a critical file for deletion.
4. Send unauthenticated request: Submit the crafted request directly to the vulnerable endpoint without any authentication headers or cookies, exploiting the lack of access controls.
5. Achieve file deletion: The server processes the traversal path and deletes the targeted file, potentially causing site outage (if core files are removed) or enabling further compromise (e.g., triggering WordPress reinstallation after deleting wp-config.php) (Patchstack).

• Network: Unusual HTTP POST or GET requests to Movie Booking plugin endpoints (e.g., /wp-admin/admin-ajax.php with action parameters related to the plugin) containing ../ or URL-encoded traversal sequences (%2e%2e%2f, %2e%2e/).
• File System: Unexpected disappearance of WordPress core files (e.g., wp-config.php, wp-login.php) or plugin/theme files; missing files in wp-content/uploads/ or wp-includes/.
• Logs: Web server access logs (Apache/Nginx) showing requests with path traversal patterns to Movie Booking plugin endpoints from external IPs; repeated 200 or 500 responses to such requests.
• Application: WordPress site returning installation wizard or database connection errors following deletion of wp-config.php; unexpected 500 errors or blank pages indicating missing core files.

The primary remediation is to update the Movie Booking plugin to version 1.1.6 or later, which contains the patch for this vulnerability (Patchstack). If immediate updating is not possible, Patchstack users can leverage the platform's virtual patching/mitigation rule to block exploitation attempts until the plugin is updated. Additional workarounds include deploying WAF rules to detect and block path traversal patterns (../, %2e%2e) in requests targeting the plugin, restricting file system permissions so the web server process cannot delete files outside the web root, and disabling the plugin entirely until patching is feasible.

Wordfence included CVE-2025-67963 in its weekly WordPress vulnerability report covering January 19–25, 2026, highlighting it among notable plugin vulnerabilities for that period (Wordfence). Patchstack, which discovered and disclosed the vulnerability, classified it as high priority and noted that unauthenticated arbitrary file deletion vulnerabilities are commonly leveraged in mass-exploit campaigns against WordPress sites. No broader media coverage or significant social media discussion has been identified.