CVE-2025-23819: WP Cloud Path Traversal Vulnerability

CVE-2025-23819 Overview

CVE-2025-23819 is an absolute path traversal vulnerability in the Marco Milesi WP Cloud plugin for WordPress. The flaw affects all versions up to and including 1.4.3. An unauthenticated remote attacker can supply a crafted absolute pathname to bypass directory restrictions and delete arbitrary files on the server. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Arbitrary file deletion in a WordPress context can lead to site takeover. Deleting wp-config.php forces the site into a setup state, allowing an attacker to point the installation to a database under their control.

Critical Impact
Unauthenticated attackers can delete arbitrary files via absolute path traversal, enabling WordPress site takeover by removing wp-config.php.

Affected Products

Marco Milesi WP Cloud plugin for WordPress
All versions from initial release through 1.4.3
WordPress installations with the WP Cloud plugin activated

Discovery Timeline

2025-02-03 - CVE-2025-23819 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23819

Vulnerability Analysis

The WP Cloud plugin accepts a file path parameter that is passed to a file deletion routine without proper validation. The plugin fails to constrain the input to the plugin's expected working directory. An attacker supplies an absolute path such as /var/www/html/wp-config.php, and the plugin operates on that path directly.

Because the vulnerable endpoint does not require authentication, exploitation requires only network access to the WordPress site. The attack consumes no user interaction and can be automated against exposed installations at scale.

The EPSS score is approximately 0.111%, indicating relatively low observed exploitation activity. However, the simplicity of the exploit and the high impact of WordPress file deletion make patching a priority.

Root Cause

The root cause is missing path canonicalization and missing allowlist enforcement on file path parameters. The plugin does not call functions such as realpath() to resolve the input, nor does it verify that the resulting path resides within the plugin's intended directory. Absolute paths are accepted verbatim and passed to filesystem operations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable WP Cloud plugin endpoint with a file path parameter containing an absolute path to a target file. The plugin then deletes the specified file.

Deleting wp-config.php is the standard escalation path. WordPress, upon detecting a missing configuration file, presents the installation wizard. The attacker completes setup with attacker-controlled database credentials, gaining administrative control and the ability to execute PHP code on the host.

No public proof-of-concept exploit code is currently available. For technical details on the specific endpoint and parameter, refer to the Patchstack WP Cloud Plugin Vulnerability advisory.

Detection Methods for CVE-2025-23819

Indicators of Compromise

Unexpected deletion or absence of wp-config.php, .htaccess, or core WordPress files
HTTP requests to WP Cloud plugin endpoints containing absolute file paths in parameters (/, C:\, ../../)
WordPress installation wizard appearing on a production site that was previously configured
New administrator accounts created shortly after suspicious requests to plugin endpoints

Detection Strategies

Inspect web server access logs for requests targeting /wp-content/plugins/cloud/ paths containing absolute file system paths as parameter values
Monitor WordPress file integrity for unexpected deletions of configuration files, core files, and plugin files
Alert on HTTP requests to the plugin that return successful status codes from unauthenticated sources
Correlate file deletion events at the operating system level with web requests to the WP Cloud plugin

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root with priority on wp-config.php and .htaccess
Forward web server logs to a centralized log platform and build queries for path traversal patterns against WP Cloud endpoints
Configure web application firewall rules to log and block requests containing absolute paths or ../ sequences in plugin parameters
Alert on creation of WordPress administrator accounts and unscheduled appearances of the installation wizard

How to Mitigate CVE-2025-23819

Immediate Actions Required

Deactivate the WP Cloud plugin until a patched version is confirmed available and installed
Restrict access to /wp-content/plugins/cloud/ at the web server or WAF layer
Audit the WordPress installation for missing files, unauthorized administrators, and modified content
Back up wp-config.php and other critical configuration files to a location outside the web root

Patch Information

No fixed version has been confirmed in the available CVE data. Versions up to and including 1.4.3 are vulnerable. Administrators should consult the Patchstack advisory and the plugin's official distribution channel for patch availability. If no patch is available, removal of the plugin is recommended.

Workarounds

Remove the WP Cloud plugin from the WordPress installation entirely if a patch is unavailable
Deploy a web application firewall rule that blocks requests to WP Cloud endpoints containing absolute paths or directory traversal sequences
Apply filesystem permissions that prevent the PHP process from deleting wp-config.php and other sensitive files where operationally feasible
Place a copy of wp-config.php one directory above the WordPress root, which WordPress supports natively, reducing exposure to plugin-level file operations

bash

# Example WAF rule (ModSecurity) to block absolute paths in WP Cloud requests
SecRule REQUEST_URI "@contains /wp-content/plugins/cloud/" \
    "chain,id:1002319,phase:2,deny,status:403,log,msg:'CVE-2025-23819 path traversal attempt'"
    SecRule ARGS "@rx ^(/|[A-Za-z]:\\\\|\.\./)" "t:none,t:urlDecodeUni"