CVE-2025-28955: Easy Video Player Path Traversal Flaw

CVE-2025-28955 Overview

CVE-2025-28955 is a path traversal vulnerability in the FWDesign Easy Video Player plugin for WordPress and WooCommerce. The flaw affects all plugin versions up to and including 10.0. Unauthenticated attackers can exploit the issue over the network to download arbitrary files from the underlying web server. The vulnerability is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Remote, unauthenticated attackers can read sensitive files outside the intended directory, including WordPress configuration files containing database credentials and authentication secrets.

Affected Products

FWDesign Easy Video Player for WordPress & WooCommerce (plugin slug fwdevp)
All versions from n/a through 10.0
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-07-16 - CVE-2025-28955 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28955

Vulnerability Analysis

The Easy Video Player plugin exposes a file download endpoint that fails to validate user-supplied path components. Attackers can supply traversal sequences such as ../ to escape the intended media directory and request arbitrary files on the host filesystem. The endpoint requires no authentication, which lowers the bar for exploitation.

Successful exploitation discloses file contents only. The CVSS vector indicates confidentiality impact without integrity or availability effects. Sensitive targets on WordPress hosts include wp-config.php, .htaccess, server logs, and SSH keys readable by the web server user.

The Patchstack advisory documents this issue as an arbitrary file download vulnerability. The EPSS probability sits at 0.498%, placing it in the 66th percentile of published CVEs. See the Patchstack Vulnerability Report for additional technical details.

Root Cause

The plugin accepts a filename parameter and passes it to file read operations without canonicalizing the path or enforcing a directory allowlist. Standard traversal payloads bypass any naive string filters.

Attack Vector

An attacker sends a crafted HTTP request to the plugin's download handler. The request includes a path parameter containing ../ sequences pointing to a target file. The server responds with the file contents. No user interaction or prior authentication is required.

Detection Methods for CVE-2025-28955

Indicators of Compromise

HTTP requests to plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences
Access log entries referencing fwdevp endpoints with unusual file, path, or name parameters
Outbound responses from the WordPress host containing contents of wp-config.php or other system files
Unexpected reads of files outside the plugin's media directory by the PHP-FPM or web server process

Detection Strategies

Inspect web server access logs for requests matching the FWDesign Easy Video Player plugin path combined with traversal patterns
Deploy WAF rules that block traversal payloads in query strings targeting the fwdevp plugin
Monitor file access telemetry on WordPress hosts for the web server user reading sensitive configuration files

Monitoring Recommendations

Alert on unauthenticated requests that result in non-media MIME types being served from plugin endpoints
Track plugin inventories across WordPress fleets to identify hosts running fwdevp version 10.0 or earlier
Correlate large response sizes from plugin download handlers with the requesting client IP for anomaly review

How to Mitigate CVE-2025-28955

Immediate Actions Required

Identify WordPress sites running FWDesign Easy Video Player version 10.0 or earlier
Disable the plugin until a patched release is installed and validated
Rotate any secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected
Review web server access logs for prior exploitation attempts referencing plugin endpoints

Patch Information

No fixed version is listed in the available advisory data. Monitor the Patchstack Vulnerability Report and the vendor's plugin distribution channel for an updated release addressing CVE-2025-28955.

Workarounds

Remove or deactivate the Easy Video Player plugin from affected WordPress installations
Block requests to plugin download endpoints at the WAF or reverse proxy layer
Restrict filesystem permissions so the web server user cannot read sensitive files outside the document root
Apply virtual patching rules that reject any request parameters containing ../ or encoded equivalents

bash

# Example ModSecurity rule blocking traversal in fwdevp requests
SecRule REQUEST_URI "@contains /wp-content/plugins/fwdevp/" \
  "chain,id:1002895,phase:2,deny,status:403,msg:'fwdevp path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.%2ف|%2e%2e%2f)" "t:lowercase,t:urlDecodeUni"