CVE-2025-6381: Beeteam368 Vidmov Path Traversal Vulnerability

CVE-2025-6381 Overview

CVE-2025-6381 is a directory traversal vulnerability in the BeeTeam368 Extensions plugin for WordPress. The flaw affects all versions up to and including 2.3.4. The vulnerability resides in the handle_remove_temp_file() function, which fails to properly validate file paths supplied by authenticated users. Attackers holding Subscriber-level access or above can delete arbitrary files on the underlying server. Deleting wp-config.php triggers WordPress reinstallation mode, allowing the attacker to connect the site to an attacker-controlled database and achieve full site takeover. The weakness is classified under [CWE-36: Absolute Path Traversal].

Critical Impact
Authenticated attackers with low-privileged Subscriber accounts can delete wp-config.php and pivot to complete WordPress site takeover.

Affected Products

BeeTeam368 Extensions plugin for WordPress, all versions through 2.3.4
WordPress sites running the Vidmov theme that bundles BeeTeam368 Extensions
Any WordPress deployment using BeeTeam368 Extensions with Subscriber registration enabled

Discovery Timeline

2025-06-28 - CVE-2025-6381 published to the National Vulnerability Database
2025-07-07 - Last updated in NVD database

Technical Details for CVE-2025-6381

Vulnerability Analysis

The vulnerability exists in the handle_remove_temp_file() function inside the BeeTeam368 Extensions plugin. This function accepts a file path parameter from an authenticated request and passes it to a file deletion routine without restricting the path to an expected temporary upload directory. Because path normalization and allow-list validation are missing, attackers can supply traversal sequences such as ../../../../ to escape the intended directory. The handler then executes deletion against files anywhere on the filesystem that the PHP process can write to.

The most damaging target is the WordPress wp-config.php file at the webroot. When WordPress detects this file is missing, it redirects all requests to the installation wizard. An attacker who triggers the deletion can then complete the installer using a remote database under their control, gaining administrative access to the site and the ability to upload plugins or themes containing PHP code.

Root Cause

The root cause is missing input validation on a file path parameter combined with insufficient capability checks. The plugin verifies only that the requester is an authenticated user, granting Subscriber accounts access to a privileged file management routine. Path traversal sequences are not stripped, and the resolved path is not constrained to the plugin's temporary file directory.

Attack Vector

The attack is performed over the network against the WordPress admin-ajax or REST endpoint that routes to handle_remove_temp_file(). The attacker first registers a Subscriber account on a site that permits open registration, or compromises any existing low-privileged account. The attacker then sends a crafted POST request containing a relative path that traverses out of the plugin directory and targets wp-config.php or another sensitive file. After deletion, the attacker navigates to the site root to trigger the reinstallation flow.

No verified public proof-of-concept code is currently available. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6381

Indicators of Compromise

Unexpected POST requests to admin-ajax endpoints invoking BeeTeam368 actions from Subscriber accounts
Request parameters containing path traversal sequences such as ../, ..%2f, or absolute paths referencing wp-config.php
Sudden presence of the WordPress installation wizard at the site root when one is not expected
Creation of new administrator accounts immediately after a wp-config.php modification or deletion event
Web server logs showing 200 responses from BeeTeam368 AJAX handlers followed by file system deletion entries

Detection Strategies

Monitor file integrity on wp-config.php and other webroot files using filesystem auditing tools or WordPress security plugins
Inspect HTTP request bodies sent to /wp-admin/admin-ajax.php for traversal patterns in parameters consumed by BeeTeam368 handlers
Correlate Subscriber-level authenticated sessions with file deletion or sensitive AJAX action calls

Monitoring Recommendations

Enable WordPress debug logging and ship logs to a centralized SIEM for analysis of plugin action invocations
Alert on any modification or deletion of wp-config.php, .htaccess, and files within wp-includes/
Track new user registrations followed within minutes by privileged AJAX actions, which suggests automated exploitation

How to Mitigate CVE-2025-6381

Immediate Actions Required

Update the BeeTeam368 Extensions plugin to a version newer than 2.3.4 as soon as the vendor releases a patched release
Disable open user registration on WordPress sites that do not require it by unchecking Settings > General > Anyone can register
Audit existing Subscriber accounts and remove any that were not provisioned by the site administrator
Back up wp-config.php and the database, and verify the integrity of webroot files

Patch Information

No fixed version has been listed in the NVD entry at the time of publication. Site administrators should consult the Wordfence Vulnerability Report and the ThemeForest product page for vendor updates. Apply the patched version immediately upon release.

Workarounds

Deactivate the BeeTeam368 Extensions plugin until a patched version is installed
Restrict the WordPress admin-ajax.php endpoint behind a web application firewall rule that blocks path traversal sequences in POST parameters
Set filesystem permissions on wp-config.php to read-only for the web server user where the application architecture permits
Enforce least-privilege roles and remove unnecessary Subscriber accounts to reduce the authenticated attack surface

bash

# Example WAF rule (ModSecurity) to block traversal in admin-ajax requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1006381,msg:'BeeTeam368 traversal attempt'"
    SecRule ARGS "@rx (\.\./|\.\.%2f|wp-config\.php)" "t:lowercase,t:urlDecodeUni"