CVE-2025-69097: 
WordPress vulnerability analysis and mitigation

CVE-2025-69097 is a Path Traversal vulnerability (CWE-22) in the VibeThemes WPLMS WordPress plugin (wplms_plugin) that allows unauthenticated remote attackers to perform arbitrary file deletion outside of restricted directories. It affects all WPLMS plugin versions up to and including 1.9.9.5.4. The vulnerability was published on January 22, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 8.6 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from insufficient validation of user-supplied file path inputs within the WPLMS plugin. An attacker can craft a network request containing path traversal sequences (e.g., ../) to escape the intended directory boundary and reference arbitrary files on the server. The attack requires no authentication, no special privileges, and no user interaction, making it exploitable by any remote actor. The Patchstack advisory specifically characterizes this as an "arbitrary file deletion" vulnerability, indicating the traversal is leveraged to delete files rather than read them (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to delete arbitrary files on the web server's filesystem, including critical WordPress core files, configuration files (e.g., wp-config.php), or other sensitive data. Deletion of key files can result in denial of service by rendering the WordPress site inoperable, and may also facilitate further compromise by removing security controls or forcing a site reinstallation that could be intercepted. The CVSS scope is rated as "Changed," indicating the impact can extend beyond the vulnerable plugin itself to the broader hosting environment (Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.021%, reflecting a low current probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WPLMS plugin (versions ≤ 1.9.9.5.4) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/wplms_plugin/readme.txt.
2. Identify vulnerable endpoint: Locate the plugin functionality that accepts a file path parameter without proper sanitization — likely a file management or media-handling endpoint exposed by the WPLMS plugin.
3. Craft traversal payload: Construct an HTTP request containing path traversal sequences (e.g., ../../wp-config.php, %2e%2e%2f, or URL-encoded variants) in the relevant parameter to escape the plugin's intended directory.
4. Send unauthenticated request: Submit the crafted request to the target WordPress site without any authentication headers or session tokens.
5. Achieve arbitrary file deletion: If successful, the server processes the traversal path and deletes the targeted file, potentially causing denial of service or enabling further attack steps such as forcing a WordPress reinstallation (Patchstack).

• Network: Unusual HTTP requests (GET or POST) to WPLMS plugin endpoints containing path traversal patterns such as ../, %2e%2e%2f, ..%2f, or %2e%2e/ in parameters; unauthenticated requests to file management endpoints of the WPLMS plugin.
• Logs: Web server access logs showing requests with traversal sequences targeting WPLMS plugin URLs; HTTP 200 responses to requests with suspicious file path parameters from unknown or unexpected IP addresses.
• File System: Unexpected disappearance of WordPress core files (e.g., wp-config.php, wp-login.php), plugin files, or other server-side files; missing files in directories outside the WPLMS plugin's intended scope.
• Application: WordPress site returning errors or becoming inaccessible following suspicious requests; missing or corrupted configuration files causing database connection failures.

Users should update the WPLMS plugin to a version beyond 1.9.9.5.4 by checking with VibeThemes for available security patches. If a patched version is not yet available or the plugin is non-critical, consider temporarily deactivating the plugin to eliminate the attack surface. As a compensating control, deploy a Web Application Firewall (WAF) with rules to detect and block common path traversal patterns (e.g., ../, %2e%2e, URL-encoded variants). Additionally, restrict web server file permissions to limit the files accessible by the web server process, and monitor access logs for traversal patterns (Patchstack).

The vulnerability was reported by Patchstack and noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of January 12–18, 2026. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database listings.