CVE-2025-6070: WordPress Restrict File Access Path Traversal

CVE-2025-6070 Overview

CVE-2025-6070 is a directory traversal vulnerability [CWE-22] in the Restrict File Access plugin for WordPress. The flaw affects all versions up to and including 1.1.2 and resides in the plugin's output() function. Authenticated users with Subscriber-level access or higher can traverse the file system and read arbitrary files on the underlying server. Attackers frequently target files such as wp-config.php, environment files, and SSH keys to harvest credentials or extend access.

Critical Impact
Any authenticated WordPress user, including low-privilege Subscribers, can read arbitrary server files. This exposes database credentials, API keys, and other secrets stored on the host.

Affected Products

Restrict File Access plugin for WordPress, all versions through 1.1.2
WordPress installations that allow Subscriber-level registration are at increased exposure
Sites hosting sensitive files readable by the web server user

Discovery Timeline

2025-06-14 - CVE-2025-6070 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-6070

Vulnerability Analysis

The Restrict File Access plugin is designed to control who can download files hosted on a WordPress site. It routes file requests through a URL rewrite handler defined in url_rewrite/url_rewrite.php. The output() function accepts a user-controlled file identifier and passes it into file system operations without sufficient path canonicalization.

Because the parameter is not restricted to a safe base directory, attackers can inject relative path sequences such as ../ to escape the intended download directory. The plugin then reads and returns the contents of the resolved path. The result is unrestricted file read within the privileges of the web server process. See the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report for reference details.

Root Cause

The root cause is missing input validation on the file path argument consumed by output(). The function does not normalize the requested path, does not reject traversal sequences, and does not confirm that the resolved file lives within an allowed directory. This falls under CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires an authenticated session at Subscriber level or higher. WordPress sites that permit open user registration make this trivially reachable. An attacker authenticates, then issues a request to the plugin's file download endpoint with a manipulated path parameter containing traversal sequences that resolve to sensitive files such as wp-config.php, /etc/passwd, or backup archives. The plugin returns the raw file contents in the HTTP response.

No verified public exploit code is currently available. The vulnerability mechanism is documented in the referenced Wordfence advisory.

Detection Methods for CVE-2025-6070

Indicators of Compromise

HTTP requests to the Restrict File Access plugin endpoints containing ../, ..%2f, or encoded traversal sequences in query parameters
Access log entries showing authenticated Subscriber accounts requesting file downloads that resolve outside the plugin's intended directory
Unexpected reads of wp-config.php, .env, or system files such as /etc/passwd from the web server process
New or unused Subscriber accounts registered shortly before suspicious file access activity

Detection Strategies

Inspect WordPress and web server access logs for requests to the restrict-file-access plugin path that include path traversal patterns
Deploy a Web Application Firewall (WAF) rule that blocks or alerts on .. sequences in the file identifier parameter handled by output()
Correlate authentication events for low-privilege accounts with file download requests to identify abuse of the plugin endpoint

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward web server logs to a central analytics platform for retention and search
Alert on any read of wp-config.php by the web server user outside of legitimate application code paths
Monitor for outbound connections from the web host that could indicate exfiltration of harvested credentials after a successful read

How to Mitigate CVE-2025-6070

Immediate Actions Required

Deactivate and remove the Restrict File Access plugin until a fixed version is confirmed and installed
Audit WordPress user accounts and disable any unused or suspicious Subscriber-level accounts
Rotate all secrets stored in wp-config.php, including database credentials, AUTH_KEY, and SECURE_AUTH_KEY values, if exploitation is suspected
Review web server access logs for the past retention window for traversal indicators against the plugin endpoint

Patch Information

No fixed version is identified in the NVD record at the time of publication. All versions up to and including 1.1.2 are vulnerable. Consult the Wordfence Vulnerability Report for the latest patch status and vendor updates.

Workarounds

Disable open user registration in WordPress general settings to reduce the population of accounts able to reach the endpoint
Restrict access to the plugin's URL rewrite handler at the web server or WAF layer using a deny rule for traversal patterns
Apply file system permissions so the web server user cannot read sensitive files such as wp-config.php beyond the minimum required
Place the WordPress installation behind a reverse proxy that normalizes and rejects requests containing encoded traversal sequences

bash

# Example Nginx rule to block traversal sequences targeting the plugin endpoint
location ~* /wp-content/plugins/restrict-file-access/ {
    if ($args ~* "\.\./|\.\.%2f|%2e%2e/") {
        return 403;
    }
}