CVE-2025-22663: Paid Videochat Path Traversal Flaw

CVE-2025-22663 Overview

CVE-2025-22663 is a path traversal vulnerability in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin. The flaw affects all plugin versions up to and including 7.2.12. An unauthenticated remote attacker can traverse outside the intended directory and delete arbitrary files on the underlying WordPress host.

The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Arbitrary file deletion in WordPress environments frequently enables follow-on attacks, including site takeover when wp-config.php is removed and reinstallation flows are triggered.

Critical Impact
Unauthenticated attackers can delete arbitrary files on the WordPress server, leading to denial of service and potential site compromise.

Affected Products

VideoWhisper Paid Videochat Turnkey Site WordPress plugin (ppv-live-webcams)
All versions from initial release through 7.2.12
WordPress sites with the plugin installed and active

Discovery Timeline

2025-02-18 - CVE-2025-22663 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22663

Vulnerability Analysis

The vulnerability resides in a file-handling routine of the ppv-live-webcams plugin that accepts user-controlled input without normalizing or validating directory components. Because the affected handler does not require authentication, any remote client can reach it over HTTP or HTTPS.

Supplying traversal sequences such as ../ in the vulnerable parameter allows the attacker to escape the plugin's working directory. The handler resolves the supplied path and performs a destructive file operation, resulting in arbitrary file deletion outside the intended scope.

The impact maps to availability rather than confidentiality or integrity. Deleting critical WordPress files, including wp-config.php, can trigger reinstallation flows that attackers leverage to gain administrative control of the site.

Root Cause

The plugin fails to canonicalize and validate file path input before passing it to a deletion function. There is no allow-list of permitted directories, no realpath() containment check, and no authentication gate on the affected endpoint. This combination satisfies the conditions for CWE-22 path traversal.

Attack Vector

The attack is fully remote and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the WordPress site with a relative path traversal payload in the affected parameter. The plugin resolves the path and deletes the targeted file from disk.

See the Patchstack advisory for ppv-live-webcams 7.2.12 arbitrary file deletion for additional technical context.

Detection Methods for CVE-2025-22663

Indicators of Compromise

HTTP requests to ppv-live-webcams plugin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in query string or POST body parameters.
Unexpected removal of WordPress core files such as wp-config.php, .htaccess, or files within wp-content/.
WordPress reinstallation screens served from a previously configured site, indicating wp-config.php removal.
Web server error log entries referencing missing PHP files after suspicious plugin requests.

Detection Strategies

Inspect web server access logs for requests targeting ppv-live-webcams PHP files combined with traversal patterns in parameter values.
Deploy a web application firewall ruleset that blocks ../, ..\\, and encoded variants in request parameters for WordPress endpoints.
Use file integrity monitoring on wp-config.php, index.php, and the wp-content/plugins/ directory to alert on unexpected deletions.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized logging platform for correlation across hosts.
Alert on bursts of DELETE-style filesystem audit events originating from the PHP-FPM or web server process user.
Track plugin version inventory across WordPress fleets to identify hosts still running ppv-live-webcams at version 7.2.12 or earlier.

How to Mitigate CVE-2025-22663

Immediate Actions Required

Identify all WordPress instances running the VideoWhisper Paid Videochat Turnkey Site plugin and confirm installed versions.
Deactivate and remove the ppv-live-webcams plugin on any host running version 7.2.12 or earlier until a patched release is applied.
Back up wp-config.php, database contents, and the wp-content/ directory before remediation.
Review web server logs for prior exploitation attempts and restore any deleted files from clean backups.

Patch Information

At the time of NVD publication, the vulnerability affects versions up to and including 7.2.12. Administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest fixed release and upgrade guidance.

Workarounds

Remove the plugin entirely if a patched version is not yet available for the deployed environment.
Add WAF rules that reject requests to ppv-live-webcams endpoints containing .., %2e%2e, or other traversal sequences in parameters.
Restrict filesystem permissions so the web server user cannot delete WordPress core files such as wp-config.php.
Place the WordPress installation behind authentication or IP allow-listing for administrative paths where business requirements permit.

bash

# Example WAF/ModSecurity rule to block path traversal toward the vulnerable plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/ppv-live-webcams/" \
  "chain,deny,status:403,id:1002201,msg:'Block path traversal targeting CVE-2025-22663'"
  SecRule ARGS|REQUEST_URI "@rx (\.\./|%2e%2e%2f|\.\.\\)" "t:lowercase,t:urlDecodeUni"