CVE-2025-13725: WordPress Gutenberg Thim Blocks Path Traversal

CVE-2025-13725 Overview

The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress contains an arbitrary file read vulnerability in all versions up to and including 1.0.1. This path traversal vulnerability (CWE-22) exists due to insufficient path validation in the server-side rendering of the thim-blocks/icon block. Authenticated attackers with Contributor-level access and above can exploit the iconSVG parameter to read arbitrary files from the server, potentially exposing sensitive configuration data.

Critical Impact

Attackers can read sensitive server files including wp-config.php, which contains database credentials, authentication keys, and other critical WordPress configuration data.

Affected Products

• Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin versions up to and including 1.0.1
• WordPress installations using the vulnerable Thim Blocks plugin
• Any WordPress site with Contributor-level or higher user accounts

Discovery Timeline

• 2026-01-17 - CVE CVE-2025-13725 published to NVD
• 2026-01-17 - Last updated in NVD database

Technical Details for CVE-2025-13725

Vulnerability Analysis

This vulnerability resides in the IconBlockType.php file within the Thim Blocks plugin. The server-side rendering logic for the icon block fails to properly sanitize and validate the iconSVG parameter before using it in file operations. This insufficient path validation allows attackers to traverse directories and access files outside the intended scope.

The vulnerability is classified as a Path Traversal (CWE-22) issue, which occurs when software uses external input to construct pathnames without properly neutralizing special elements. In this case, the lack of validation allows path manipulation sequences like ../ to escape the expected directory structure.

Exploitation requires authenticated access at the Contributor level or above. While this raises the barrier to entry compared to unauthenticated vulnerabilities, WordPress sites with multiple contributors or compromised low-privilege accounts remain at significant risk. The impact is focused on confidentiality, allowing attackers to exfiltrate sensitive configuration files and potentially obtain database credentials.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and path canonicalization on the iconSVG parameter within the IconBlockType.php file. The vulnerable code at lines 92 and 97 accepts user-controlled input and uses it in file operations without verifying that the resulting path remains within the expected directory boundaries.

Secure implementations should validate that resolved file paths stay within designated directories using functions like realpath() combined with prefix checking, or by using an allowlist of permitted file locations.

Attack Vector

The attack is network-based and requires authenticated access with at least Contributor privileges. An attacker would craft a malicious block configuration containing path traversal sequences in the iconSVG parameter. When the server renders this block, it follows the manipulated path to read arbitrary files.

The vulnerability allows reading files accessible to the web server process. High-value targets include:

• wp-config.php - Contains database credentials and WordPress security keys
• .htaccess - May reveal server configuration details
• Database backup files if stored within the web root
• Other plugin configuration files with API keys or credentials

For technical implementation details, refer to the WordPress Icon Block source code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13725

Indicators of Compromise

• Unusual file access patterns in web server logs targeting the Thim Blocks plugin endpoints
• Requests containing path traversal sequences (../, ..%2f, ..%252f) in icon-related parameters
• Access attempts to sensitive files like wp-config.php from plugin rendering contexts
• Unexpected read operations on configuration files in file integrity monitoring logs

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns in POST requests to WordPress
• Review WordPress user activity logs for Contributor-level accounts creating or editing blocks with suspicious icon configurations
• Implement file integrity monitoring on wp-config.php and other sensitive configuration files
• Analyze server access logs for requests to IconBlockType.php with unusual parameter values

Monitoring Recommendations

• Enable detailed logging for the WordPress REST API and block editor endpoints
• Configure alerts for file read operations outside expected plugin directories
• Monitor for new or modified posts/pages containing the thim-blocks/icon block type
• Implement real-time alerting on access attempts to sensitive WordPress configuration files

How to Mitigate CVE-2025-13725

Immediate Actions Required

• Update the Gutenberg Thim Blocks plugin to the latest patched version immediately
• Audit WordPress user accounts and remove unnecessary Contributor-level access
• Review recent activity from Contributor-level accounts for suspicious block editing
• Consider temporarily deactivating the plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in updates to the Thim Blocks plugin. Security patches are documented in WordPress Code Changeset 3419638 and Changeset 3424998. WordPress administrators should update through the WordPress plugin dashboard or download the latest version from the WordPress plugin repository.

Workarounds

• If patching is not immediately possible, temporarily disable the Thim Blocks plugin until it can be updated
• Implement Web Application Firewall (WAF) rules to block path traversal attempts targeting WordPress plugins
• Restrict Contributor-level access to trusted users only and audit existing user permissions
• Move sensitive configuration files outside the web root where possible, or implement additional access controls

# Configuration example
# Disable Thim Blocks plugin via WP-CLI until patch is applied
wp plugin deactivate thim-blocks

# List users with Contributor role for audit
wp user list --role=contributor --fields=ID,user_login,user_email

# Check current plugin version
wp plugin get thim-blocks --fields=version,status