CVE-2025-67963: Movie Booking Path Traversal Vulnerability

CVE-2025-67963 Overview

CVE-2025-67963 is a Path Traversal vulnerability affecting the Movie Booking WordPress plugin developed by ovatheme. This security flaw allows attackers to manipulate file paths to access or delete files outside of intended directory boundaries. The vulnerability stems from improper limitation of a pathname to a restricted directory (CWE-22), enabling arbitrary file deletion on affected WordPress installations.

Critical Impact

Attackers can exploit this path traversal vulnerability to delete arbitrary files on the WordPress server, potentially leading to complete site compromise, data loss, or denial of service by removing critical system files.

Affected Products

• ovatheme Movie Booking WordPress Plugin version 1.1.5 and earlier
• WordPress installations running vulnerable versions of the movie-booking plugin

Discovery Timeline

• 2026-01-22 - CVE CVE-2025-67963 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-67963

Vulnerability Analysis

This Path Traversal vulnerability exists in the Movie Booking WordPress plugin due to insufficient validation of user-supplied file path input. The plugin fails to properly sanitize path components, allowing attackers to use directory traversal sequences (such as ../) to escape the intended directory structure and access or manipulate files elsewhere on the filesystem.

The vulnerability enables arbitrary file deletion, which represents a severe security risk. An attacker could delete the wp-config.php file to trigger WordPress reinstallation, remove security plugins, or delete backup files. In multi-site environments, this could affect multiple WordPress installations on the same server.

Root Cause

The root cause is improper input validation in file handling routines within the Movie Booking plugin. The plugin does not adequately sanitize user-controlled input that is used to construct file paths, failing to strip or block directory traversal sequences before performing file operations. This allows malicious actors to craft requests that reference files outside the plugin's intended directory scope.

Attack Vector

The attack vector involves sending specially crafted requests to the vulnerable plugin endpoint containing path traversal sequences. An attacker would construct a malicious file path parameter that includes sequences like ../ to navigate up the directory tree and target files outside the plugin's designated folder structure.

For example, an attacker might submit a request where a filename parameter contains ../../../../wp-config.php to reference the WordPress configuration file. The vulnerable plugin would then process this path without proper validation, potentially deleting the targeted file.

Technical details and proof-of-concept information are available in the Patchstack Vulnerability Analysis.

Detection Methods for CVE-2025-67963

Indicators of Compromise

• Unexpected file deletions in WordPress directories, particularly core files like wp-config.php
• Web server logs showing requests with path traversal patterns (e.g., ../, ..%2f, ..%5c) targeting the movie-booking plugin
• Missing WordPress files that were previously present without administrative action
• WordPress site entering setup mode unexpectedly due to missing configuration files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal sequences targeting the movie-booking plugin endpoints
• Monitor file integrity on WordPress installations to detect unauthorized file deletions or modifications
• Review web server access logs for suspicious patterns including encoded directory traversal attempts
• Deploy endpoint detection solutions that can identify file system manipulation attempts

Monitoring Recommendations

• Enable file integrity monitoring on critical WordPress files including wp-config.php, .htaccess, and plugin directories
• Configure alerts for any file deletion events in the WordPress installation directory
• Implement centralized logging for all WordPress plugin HTTP requests to enable forensic analysis
• Monitor for requests to the movie-booking plugin containing unusual path characters or encoding

How to Mitigate CVE-2025-67963

Immediate Actions Required

• Deactivate and remove the Movie Booking plugin from WordPress installations running version 1.1.5 or earlier until a patched version is available
• Review file system integrity to identify any files that may have been deleted through exploitation
• Implement WAF rules to block path traversal attempts targeting WordPress plugins
• Restrict file system permissions to limit the impact of potential exploitation

Patch Information

Users should check for updates to the Movie Booking plugin from ovatheme. Until a patched version is released, the plugin should be removed from production WordPress installations. Monitor the Patchstack advisory for updates on patch availability.

Workarounds

• Remove the Movie Booking plugin entirely if the functionality is not critical to site operations
• Implement server-level path traversal filtering through .htaccess or web server configuration
• Use a WordPress security plugin with virtual patching capabilities to block exploitation attempts
• Apply the principle of least privilege to the web server user account to limit file deletion capabilities

# Example .htaccess rule to block path traversal attempts
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.\\) [NC]
    RewriteRule .* - [F,L]
</IfModule>