CVE-2025-39491: WHMpress Path Traversal Vulnerability

CVE-2025-39491 Overview

CVE-2025-39491 is a path traversal vulnerability affecting the WHMpress WordPress plugin. The flaw allows unauthenticated attackers to traverse directories outside the plugin's intended file scope. This results in local file inclusion (LFI) conditions on affected WordPress installations. The issue affects WHMpress from version 6.2 through revision.

The vulnerability is classified under [CWE-35] (Path Traversal: '.../...//') and carries network attack characteristics with no privileges or user interaction required. Attackers can read sensitive server files, including WordPress configuration data containing database credentials and authentication keys.

Critical Impact
Unauthenticated attackers can read arbitrary files on the server, exposing credentials, configuration data, and source code that enable further compromise of the WordPress installation.

Affected Products

WHMpress WordPress plugin version 6.2
WHMpress versions through revision 9
WordPress sites running the vulnerable WHMpress plugin

Discovery Timeline

2025-05-16 - CVE-2025-39491 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-39491

Vulnerability Analysis

The WHMpress plugin fails to properly sanitize user-supplied input used in file path construction. Attackers can supply traversal sequences such as ../ to escape the intended directory and reference arbitrary files on the underlying server. Because the plugin loads or includes the referenced file, the issue manifests as local file inclusion.

The vulnerability requires no authentication, allowing remote attackers to send crafted HTTP requests to the affected plugin endpoint. Successful exploitation discloses file contents accessible to the web server user. Targets commonly include wp-config.php, which contains database credentials and WordPress secret keys.

The EPSS probability for this issue is 0.393% with a percentile of 60.38, indicating moderate predicted exploitation interest relative to other published vulnerabilities.

Root Cause

The root cause is insufficient validation of file path parameters passed through HTTP requests to the plugin. The code constructs file paths by concatenating user input without canonicalizing the resulting path or restricting it to an allow-listed directory. Directory traversal sequences are accepted and resolved by the underlying file system.

Attack Vector

The attack vector is network-based through standard HTTP or HTTPS requests to the WordPress site. An attacker submits a request to a vulnerable WHMpress endpoint with a file parameter containing traversal sequences. The plugin reads the file and returns or processes its contents, exposing data to the attacker.

No example exploitation code is published in verified public sources. Technical details are documented in the Patchstack WHMPress Plugin Vulnerability advisory.

Detection Methods for CVE-2025-39491

Indicators of Compromise

HTTP requests to WHMpress plugin endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f
Unexpected access patterns referencing wp-config.php, /etc/passwd, or other sensitive file paths in web server logs
Outbound connections from the WordPress host following suspicious file read activity
New administrative WordPress accounts created shortly after suspicious plugin requests

Detection Strategies

Inspect web server access logs for requests targeting /wp-content/plugins/whmpress/ with file parameters containing traversal patterns
Deploy web application firewall (WAF) rules that flag directory traversal payloads against WordPress plugin paths
Correlate file read anomalies on WordPress hosts with inbound HTTP requests using endpoint telemetry

Monitoring Recommendations

Enable verbose access logging on WordPress reverse proxies and origin servers
Monitor file system access patterns to wp-config.php and other sensitive files outside normal application flow
Alert on repeated 200 responses from WHMpress endpoints with abnormal query string structures

How to Mitigate CVE-2025-39491

Immediate Actions Required

Update WHMpress to the latest patched revision published by the vendor
Audit web server logs for prior exploitation attempts and signs of successful file disclosure
Rotate all credentials stored in wp-config.php, including database passwords and WordPress authentication keys
Review WordPress user accounts for unauthorized additions or privilege changes

Patch Information

Refer to the Patchstack WHMPress Plugin Vulnerability advisory for fixed version details. Apply the vendor-supplied update to the WHMpress plugin through the WordPress administrative interface or by replacing the plugin files manually.

Workarounds

Disable the WHMpress plugin until a patched version is installed if updates cannot be applied immediately
Restrict access to plugin endpoints via WAF rules blocking traversal sequences in request parameters
Apply least-privilege file system permissions so the web server user cannot read sensitive files outside the WordPress document root where feasible

bash

# Example WAF rule pattern (ModSecurity) blocking traversal payloads
SecRule REQUEST_URI "@contains /wp-content/plugins/whmpress/" \
    "chain,deny,status:403,id:1009100,msg:'WHMpress path traversal attempt'"
    SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase,t:urlDecodeUni"