CVE-2025-6070

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
josxha	Restrict File Access	<= 1.1.2

References

Timeline

Published: Jun 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-607006.5A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `librcm.so` binar CVE-2025-607016.5A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` and `rc` binaries. Th CVE-2025-607026.5A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The CVE-2025-607037.8Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.CVE-2025-607047.5Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.CVE-2025-607057.8Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2025-607065.5Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.CVE-2025-607077.8Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally.CVE-2025-607086.5Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.CVE-2025-607097.8Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2025-60715.3Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to d CVE-2025-607107.8Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate pr