CVE-2025-28980: Aviation Weather from NOAA Path Traversal

CVE-2025-28980 Overview

CVE-2025-28980 is a path traversal vulnerability in the aviation-weather-from-noaa WordPress plugin developed by machouinard. The flaw affects all versions of Aviation Weather from NOAA up to and including 0.7.2. Authenticated attackers with low privileges can traverse outside the intended directory and delete arbitrary files on the underlying server. Successful exploitation compromises site availability and can enable follow-on attacks such as WordPress reinstallation abuse. The issue is tracked as CWE-22 and was published to the National Vulnerability Database on July 4, 2025.

Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress host, causing denial of service and potential full site takeover through wp-config.php deletion.

Affected Products

Aviation Weather from NOAA WordPress plugin (aviation-weather-from-noaa) versions up to and including 0.7.2
WordPress sites with the machouinard Aviation Weather from NOAA plugin installed and activated
All hosting environments running the vulnerable plugin, regardless of underlying WordPress core version

Discovery Timeline

2025-07-04 - CVE-2025-28980 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28980

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory within the Aviation Weather from NOAA plugin. The plugin accepts file path input from an authenticated user and passes it to a file deletion routine without adequately validating or canonicalizing the supplied path. Attackers can inject directory traversal sequences such as ../ to escape the plugin's intended working directory. This allows arbitrary file deletion anywhere the PHP process has write access on the server filesystem.

The attack requires network access and low-level authenticated privileges but no user interaction. The scope is changed, meaning the vulnerable component can affect resources beyond its own security scope. While confidentiality and integrity impacts are rated none, availability impact is high because deleting critical files like wp-config.php triggers WordPress installation mode and can enable full site takeover.

Root Cause

The root cause is missing input sanitization on a user-controlled file path parameter. The plugin does not restrict deletion operations to a whitelist of allowed files or enforce a canonicalized base directory check. Standard defenses such as realpath() validation against an allowed prefix are absent, permitting ../ sequences to reach the deletion sink.

Attack Vector

An authenticated attacker with subscriber-level or higher privileges submits a crafted request to the plugin's file deletion endpoint. The request includes a filename or equivalent parameter containing traversal sequences pointing to sensitive files outside the plugin directory. The plugin invokes unlink() on the resolved path, removing the targeted file. Refer to the Patchstack Vulnerability Report for technical details on the vulnerable code path.

Detection Methods for CVE-2025-28980

Indicators of Compromise

Unexpected deletion of files under the WordPress document root, particularly wp-config.php, .htaccess, or plugin core files
Web server access logs containing ../ sequences or URL-encoded equivalents (%2e%2e%2f) in requests targeting aviation-weather-from-noaa endpoints
WordPress site unexpectedly entering installation setup mode, indicating wp-config.php removal
Authenticated POST or AJAX requests from low-privilege user accounts to plugin admin actions

Detection Strategies

Inspect WordPress access logs for requests to admin-ajax.php or plugin-specific endpoints containing path traversal patterns
Monitor file integrity of the WordPress installation directory using file integrity monitoring (FIM) tools
Alert on any deletion of wp-config.php, .htaccess, or files outside /wp-content/plugins/aviation-weather-from-noaa/
Correlate authenticated session activity from low-privilege roles with filesystem modification events

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward events to a centralized logging platform for query and correlation
Track unlink() and file deletion syscalls on the PHP-FPM or Apache worker processes serving the site
Review user role assignments and audit which accounts have access to plugin-specific admin actions
Set up alerts for HTTP requests containing traversal sequences targeting known WordPress plugin paths

How to Mitigate CVE-2025-28980

Immediate Actions Required

Deactivate and remove the Aviation Weather from NOAA plugin until a patched version is available and installed
Audit WordPress user accounts and remove or reduce privileges for unnecessary low-trust users
Restore any deleted files from backups and validate the integrity of wp-config.php and .htaccess
Rotate WordPress secrets and database credentials if wp-config.php was exposed or deleted

Patch Information

At the time of publication, no fixed version beyond 0.7.2 has been confirmed in the Patchstack Vulnerability Report. Monitor the WordPress plugin repository for an updated release and apply it immediately upon availability.

Workarounds

Remove the plugin entirely from any production WordPress installation as the most reliable mitigation
Deploy a web application firewall (WAF) rule that blocks requests containing ../ or URL-encoded traversal sequences to plugin endpoints
Restrict PHP process filesystem permissions using open_basedir to prevent traversal outside the WordPress root
Enforce least-privilege user roles and disable open registration on affected WordPress sites

bash

# Example open_basedir restriction in php.ini or vhost configuration
php_admin_value open_basedir "/var/www/html/wordpress/:/tmp/"