CVE-2025-66074: WP Webhooks Path Traversal Vulnerability

CVE-2025-66074 Overview

CVE-2025-66074 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the WP Webhooks plugin by Cozmoslabs for WordPress. This vulnerability allows attackers to upload arbitrary files with dangerous types, enabling path traversal attacks. The vulnerability affects WP Webhooks versions through 3.3.8.

Critical Impact

Attackers with low-level authentication can upload malicious files to arbitrary locations on the server, potentially leading to remote code execution, complete site compromise, and lateral movement within the hosting infrastructure.

Affected Products

• WP Webhooks plugin versions through 3.3.8
• WordPress installations using vulnerable WP Webhooks versions
• Cozmoslabs WP Webhooks (wp-webhooks)

Discovery Timeline

• 2025-12-18 - CVE CVE-2025-66074 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-66074

Vulnerability Analysis

This vulnerability exists in the file upload functionality of the WP Webhooks plugin. The plugin fails to properly validate and restrict file types during the upload process, allowing attackers to bypass intended security controls. The vulnerability requires network access with low-level privileges and some user interaction, but once exploited, it can impact resources beyond the vulnerable component's scope, affecting confidentiality, integrity, and availability of the entire WordPress installation.

The combination of unrestricted file upload with path traversal capabilities creates a particularly dangerous attack surface. An attacker can not only upload malicious files such as PHP web shells but can also manipulate the upload path to place these files in strategic locations within the WordPress directory structure or potentially outside of it.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and file type restriction mechanisms within the WP Webhooks plugin's file handling code. The plugin does not adequately sanitize user-supplied filenames or enforce strict allowlists for permitted file extensions. Additionally, path components within the upload request are not properly validated, allowing directory traversal sequences to be processed.

Attack Vector

The attack is network-based and requires the attacker to have low-level privileges on the WordPress installation. The exploitation process involves:

1. An authenticated user with minimal privileges accesses the vulnerable file upload endpoint
2. The attacker crafts a malicious request containing a dangerous file type (such as a PHP script)
3. Path traversal sequences (e.g., ../) are included in the filename or upload path parameter
4. The server processes the upload without proper validation, writing the malicious file to an attacker-controlled location
5. The attacker can then execute the uploaded file to gain further access or execute arbitrary code

The vulnerability mechanism involves improper handling of file uploads in the WP Webhooks plugin. When processing upload requests, the plugin fails to validate the file extension against a secure allowlist and does not sanitize path components to prevent directory traversal. For detailed technical analysis, see the Patchstack WordPress Plugin Advisory.

Detection Methods for CVE-2025-66074

Indicators of Compromise

• Unexpected PHP files or scripts appearing in WordPress directories outside of standard plugin/theme folders
• Web server access logs showing POST requests to WP Webhooks endpoints with unusual filenames or path traversal patterns (../)
• Newly created or modified files with execution permissions in web-accessible directories
• Presence of web shells or backdoor scripts in the WordPress installation

Detection Strategies

• Monitor file system changes in the WordPress installation directory using file integrity monitoring tools
• Analyze web server access logs for suspicious file upload requests containing path traversal sequences
• Implement Web Application Firewall (WAF) rules to detect and block malicious file upload attempts
• Review WordPress user activity logs for unusual plugin interactions or file operations

Monitoring Recommendations

• Enable detailed logging for the WordPress uploads directory and WP Webhooks plugin activity
• Configure alerts for new file creations with executable extensions (.php, .phtml, .phar)
• Implement real-time file integrity monitoring for critical WordPress directories
• Set up network monitoring to detect outbound connections from newly created files

How to Mitigate CVE-2025-66074

Immediate Actions Required

• Update WP Webhooks plugin to a patched version beyond 3.3.8 immediately
• Audit the WordPress installation for any suspicious files that may have been uploaded
• Review user accounts with plugin access and remove unnecessary privileges
• Temporarily disable the WP Webhooks plugin if an update is not immediately available

Patch Information

Users should upgrade the WP Webhooks plugin to the latest available version that addresses this vulnerability. Check the Patchstack WordPress Plugin Advisory for the most current patch information and remediation guidance from the vendor.

Workarounds

• Restrict access to the WP Webhooks plugin functionality to only trusted administrators
• Implement server-level file upload restrictions to block dangerous file types
• Configure .htaccess rules to prevent PHP execution in upload directories
• Use a Web Application Firewall (WAF) to filter malicious upload requests

# Apache .htaccess configuration to prevent PHP execution in uploads
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.(?:php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Alternative for older Apache versions
<FilesMatch "\.(?:php|phtml|phar|php[0-9])$">
    Order Allow,Deny
    Deny from all
</FilesMatch>