CVE-2025-3294: Benjaminrojas WP Editor RCE Vulnerability

CVE-2025-3294 Overview

The WP Editor plugin for WordPress contains an arbitrary file update vulnerability affecting all versions up to and including 1.2.9.1. The flaw stems from missing file path validation, allowing authenticated attackers with Administrator-level access to overwrite arbitrary files on the server. When the web server has write permissions to sensitive PHP files, this can escalate to remote code execution. The vulnerability is tracked under CWE-22 (Path Traversal). The EPSS score of 1.805% places this vulnerability in the 83rd percentile for likelihood of exploitation.

Critical Impact
Authenticated administrators can overwrite arbitrary server files, potentially leading to remote code execution and full site compromise.

Affected Products

WP Editor plugin for WordPress, all versions through 1.2.9.1
WordPress installations with the benjaminrojas/wp_editor plugin installed and activated
Sites where the web server process has write access to PHP files outside the plugin directory

Discovery Timeline

2025-04-17 - CVE-2025-3294 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-3294

Vulnerability Analysis

The WP Editor plugin provides administrators with a file-editing interface for theme and plugin files within WordPress. The vulnerability arises from the plugin's failure to validate or sanitize file paths supplied by users when writing edited content back to disk. An authenticated attacker with Administrator privileges can supply a crafted file path that escapes the intended editor scope and points to arbitrary files on the underlying filesystem.

Because WordPress administrators are highly privileged, this issue is most relevant in multi-administrator environments, hosting platforms where administrator credentials may be compromised, or scenarios involving session hijacking and credential theft. The path traversal classification [CWE-22] reflects the absence of canonicalization on file path inputs before the write operation. Successful exploitation enables an attacker to overwrite WordPress core files, other plugin files, or .htaccess rules, converting an administrator account into a vehicle for remote code execution.

Root Cause

The plugin accepts a file path parameter from the editor interface and passes it to file write routines without verifying that the resolved path remains inside the allowed editor directory. The corrective changeset published by the maintainer adds path validation against an allowlist of permitted directories before any write operation proceeds.

Attack Vector

An attacker first obtains Administrator-level credentials through phishing, credential reuse, or chained vulnerabilities. The attacker then issues a request to the WP Editor save endpoint with a file path containing traversal sequences such as ../ or an absolute path targeting files outside the editor scope. The plugin writes the supplied content to the attacker-chosen location, overwriting the file. If the target is an executable PHP file reachable from the web, the attacker triggers code execution by requesting the modified resource.

No verified public proof-of-concept is currently available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-3294

Indicators of Compromise

Unexpected modification timestamps on WordPress core files, theme files, or plugin files that were not edited by legitimate administrators
New or modified PHP files containing obfuscated code, eval() calls, or base64-encoded payloads inside the WordPress directory tree
Web server access log entries showing POST requests to WP Editor endpoints with path parameters containing ../ sequences or absolute paths
Unexplained changes to .htaccess, wp-config.php, or index.php files

Detection Strategies

Monitor file integrity across the WordPress installation directory and alert on changes to files outside the editor's permitted scope
Inspect web server and PHP error logs for traversal patterns in WP Editor request parameters
Audit the WordPress activity log for file edit events performed by administrator accounts, especially outside normal change windows
Compare installed WordPress core and plugin files against known-good hashes from upstream releases

Monitoring Recommendations

Enable WordPress audit logging plugins to capture administrator actions including file edits and plugin operations
Forward web server access logs and WordPress logs to a centralized logging platform for correlation and retention
Alert on creation of new PHP files inside wp-content/uploads/ or other directories that should not contain executable code
Track administrator account logins from unusual IP addresses, geographies, or user agents

How to Mitigate CVE-2025-3294

Immediate Actions Required

Update the WP Editor plugin to a version newer than 1.2.9.1 that includes the fix from the WordPress Changeset Update
If a patched version is not yet available in your environment, deactivate and remove the WP Editor plugin
Review all administrator accounts and remove any that are not strictly required
Enforce strong, unique passwords and multi-factor authentication for all administrator accounts

Patch Information

The vendor published a fix in the WP Editor plugin trunk via the WordPress plugin repository. The relevant changeset (revision 3269832, replacing 3151053) introduces file path validation before write operations. Site operators should upgrade through the WordPress plugin management interface or via WP-CLI to ensure the patched code is deployed.

Workarounds

Set the WordPress configuration constant DISALLOW_FILE_EDIT to true in wp-config.php to disable in-dashboard file editing entirely
Restrict filesystem permissions so the web server user cannot write to WordPress core files, theme files, or plugin files outside designated upload directories
Place the WP Editor administrative endpoints behind IP allowlisting or a web application firewall rule that blocks traversal sequences in path parameters

bash

# Add to wp-config.php to disable file editing from the dashboard
define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );

# Update the WP Editor plugin via WP-CLI
wp plugin update wp-editor

# Verify installed version is greater than 1.2.9.1
wp plugin get wp-editor --field=version