CVE-2025-14829: E-xact Hosted Payment Path Traversal Flaw

CVE-2025-14829 Overview

CVE-2025-14829 affects the E-xact Hosted Payment WordPress plugin through version 2.0. The vulnerability allows unauthenticated attackers to delete arbitrary files on the server through insufficient file path validation. The flaw is classified as a path traversal issue leading to arbitrary file deletion [CWE-22, CWE-73].

An attacker can exploit this issue remotely over the network without authentication or user interaction. Deletion of critical files such as wp-config.php can force WordPress into a setup state, enabling site takeover.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on the WordPress server, potentially leading to full site compromise when wp-config.php is removed.

Affected Products

E-xact Hosted Payment WordPress plugin, all versions up to and including 2.0
WordPress installations using the plugin for payment processing
Sites running the plugin without an applied patch

Discovery Timeline

2026-01-13 - CVE-2025-14829 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14829

Vulnerability Analysis

The E-xact Hosted Payment plugin exposes functionality that accepts a file path parameter and passes it to a file deletion routine without sufficient validation. The plugin fails to verify that the supplied path resolves to a location intended for deletion, and it does not enforce authentication on the affected endpoint.

An unauthenticated attacker can submit a crafted request containing directory traversal sequences in the file path parameter. The plugin then resolves the path relative to the WordPress installation and deletes the targeted file. This pattern is a classic path traversal flaw leading to arbitrary file deletion.

Deletion of wp-config.php is the most impactful attack outcome. WordPress treats a missing wp-config.php as an uninstalled state and redirects visitors to the setup wizard. An attacker can then point the installation at an attacker-controlled database and gain administrative control.

Root Cause

The root cause is missing canonicalization and authorization checks in the plugin's file handling logic. The plugin does not validate that the resolved path stays inside an expected directory, and it does not require a logged-in user or capability check before performing destructive file operations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a single HTTP request to the vulnerable plugin endpoint with a traversal payload in the file path parameter. The deletion executes with the privileges of the PHP process running WordPress.

No verified public proof-of-concept is currently available. Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2025-14829

Indicators of Compromise

Missing wp-config.php file or unexpected redirection to the WordPress setup wizard at /wp-admin/setup-config.php
HTTP requests to E-xact Hosted Payment plugin endpoints containing ../ sequences or absolute paths in parameters
Web server access logs showing unauthenticated POST or GET requests to plugin handlers from unfamiliar IP addresses
Sudden disappearance of files within the WordPress directory tree or plugin directories

Detection Strategies

Monitor web access logs for requests to /wp-content/plugins/ paths associated with the E-xact plugin that include traversal characters
Deploy file integrity monitoring on the WordPress document root, especially wp-config.php and .htaccess
Alert on HTTP responses indicating successful 200 status codes paired with parameters containing path traversal patterns

Monitoring Recommendations

Enable WordPress audit logging to capture plugin activity and unauthenticated requests to plugin endpoints
Forward web server and PHP error logs to a centralized log platform for correlation across hosts
Track filesystem deletion events using operating system audit subsystems such as auditd on Linux

How to Mitigate CVE-2025-14829

Immediate Actions Required

Deactivate and remove the E-xact Hosted Payment plugin from all WordPress installations until a fixed version is released
Restrict access to the WordPress wp-content/plugins/ directory using web application firewall rules that block traversal patterns
Verify the integrity of wp-config.php and back it up to a location outside the web root
Rotate database credentials and WordPress secret keys if compromise is suspected

Patch Information

No vendor patch is referenced in the public advisory. The vulnerability affects all versions of the plugin through 2.0. Administrators should consult the WPScan Vulnerability Report for the latest remediation status and remove the plugin until an official fix is published.

Workarounds

Uninstall the plugin and replace it with an actively maintained payment integration
Configure a web application firewall to block requests containing ../ or null bytes in query parameters and POST bodies targeting plugin paths
Restrict filesystem permissions so the PHP process cannot delete wp-config.php or files outside expected upload directories

bash

# Example: deactivate the plugin via WP-CLI
wp plugin deactivate e-xact-hosted-payment
wp plugin delete e-xact-hosted-payment

# Example: tighten permissions on wp-config.php
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php