CVE-2025-46486: Nomupay Payment Gateway Path Traversal

CVE-2025-46486 Overview

CVE-2025-46486 is a path traversal vulnerability in the totalprocessing Nomupay Payment Processing Gateway plugin for WordPress. The flaw affects the totalprocessing-card-payments plugin from unspecified versions through 7.1.7. An authenticated attacker with high privileges can traverse outside the intended directory and download arbitrary files from the server. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact

Authenticated attackers can read sensitive files outside the plugin's intended directory, exposing configuration files, credentials, and other server-side data.

Affected Products

• totalprocessing Nomupay Payment Processing Gateway plugin for WordPress
• Plugin slug: totalprocessing-card-payments
• All versions up to and including 7.1.7

Discovery Timeline

• 2025-05-23 - CVE CVE-2025-46486 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46486

Vulnerability Analysis

The vulnerability resides in file-handling logic within the Nomupay Payment Processing Gateway plugin. The plugin accepts a user-controlled file path parameter without properly restricting the path to an intended base directory. An attacker with sufficient privileges can supply directory traversal sequences such as ../ to escape the plugin's working directory. This produces an arbitrary file download primitive on the underlying host.

Patchstack tracks this issue as an arbitrary file download vulnerability affecting versions up to 7.1.7. Exploitation exposes file contents but does not, on its own, alter integrity or availability. Sensitive targets include wp-config.php, backup archives, and any file readable by the web server user.

Root Cause

The plugin fails to canonicalize and validate file path inputs against an allowlisted base directory. Missing sanitization of path separators and traversal sequences allows the requested path to resolve outside the intended location. This is a classic [CWE-22] pattern.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated access at a high privilege level. No user interaction is required. The attacker issues a crafted request to the vulnerable plugin endpoint, injecting traversal sequences into the file parameter. The server returns the contents of the traversed file.

See the Patchstack Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-46486

Indicators of Compromise

• HTTP requests to plugin endpoints containing traversal sequences such as ../, ..%2f, or encoded variants in a file or path parameter.
• Web server access logs showing successful responses returning content of sensitive files such as wp-config.php or /etc/passwd.
• Unexpected outbound transfers or downloads originating from authenticated administrative sessions.

Detection Strategies

• Inspect WordPress request logs for query parameters referencing files outside the plugin's directory tree.
• Deploy web application firewall rules that block directory traversal patterns targeting totalprocessing-card-payments endpoints.
• Correlate authenticated administrator activity with anomalous file-access response sizes returned by plugin URLs.

Monitoring Recommendations

• Alert on repeated 200-response requests to plugin endpoints with encoded path characters in parameters.
• Monitor for reads of high-value files such as wp-config.php, .env, and database backups served through PHP.
• Track privileged account activity for unusual plugin-endpoint access outside routine administrative tasks.

How to Mitigate CVE-2025-46486

Immediate Actions Required

• Identify all WordPress sites running the Nomupay Payment Processing Gateway plugin at version 7.1.7 or earlier.
• Deactivate and remove the plugin until a patched version is confirmed available from the vendor.
• Rotate any credentials, API keys, or secrets stored in files that may have been readable by the web server, including database credentials in wp-config.php.

Patch Information

As of the last NVD update on 2026-06-17, the advisory identifies affected versions through 7.1.7. Consult the Patchstack Vulnerability Analysis and the vendor's plugin repository for a fixed release. Apply the vendor patch as soon as it becomes available.

Workarounds

• Restrict administrative access to the WordPress dashboard using IP allowlists and enforce multi-factor authentication on all high-privilege accounts.
• Configure a web application firewall to block traversal sequences targeting plugin endpoints.
• Apply least-privilege file permissions so the web server user cannot read files outside the WordPress document root.
• Remove the plugin if a payment gateway alternative is available and business requirements permit.