CVE-2025-69379: Upload Files Anywhere Path Traversal

CVE-2025-69379 Overview

CVE-2025-69379 is a Path Traversal vulnerability affecting the Upload Files Anywhere WordPress plugin (wp-upload-files-anywhere) developed by vanquish. This vulnerability allows unauthenticated attackers to traverse directory paths and potentially delete arbitrary files on the server through improper limitation of pathnames to restricted directories.

The vulnerability stems from insufficient input validation when handling file path parameters, enabling attackers to use path traversal sequences (such as ../) to escape the intended upload directory and access or manipulate files elsewhere on the filesystem.

Critical Impact

Unauthenticated attackers can exploit this path traversal flaw to delete arbitrary files on WordPress installations, potentially leading to complete site compromise or denial of service through deletion of critical system files.

Affected Products

• Upload Files Anywhere WordPress Plugin versions up to and including 2.8
• WordPress installations with the wp-upload-files-anywhere plugin active

Discovery Timeline

• 2026-02-20 - CVE CVE-2025-69379 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-69379

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in the Upload Files Anywhere plugin's file handling functionality, which fails to properly sanitize user-supplied input containing directory traversal sequences.

The vulnerability can be exploited remotely over the network without requiring authentication or user interaction, making it particularly dangerous for public-facing WordPress installations. Successful exploitation results in arbitrary file deletion capabilities, which can cause significant disruption to site availability and integrity.

Root Cause

The root cause of CVE-2025-69379 lies in the plugin's failure to properly validate and sanitize file path inputs before performing file operations. When processing file deletion requests, the plugin does not adequately check for path traversal sequences such as ../ or encoded variants like %2e%2e%2f. This allows attackers to construct malicious paths that escape the intended directory boundaries and reference files in other locations on the server's filesystem.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation without authentication. An attacker can craft malicious HTTP requests to the vulnerable WordPress plugin endpoint, including path traversal sequences in the file path parameter. The plugin processes these requests without proper validation, allowing the attacker to reference and delete files outside the designated upload directory.

For example, an attacker could target critical WordPress files like wp-config.php or .htaccess, effectively taking down the site or exposing it to further attacks. The ability to delete files without authentication makes this vulnerability particularly severe for exposed WordPress installations.

Technical details and proof-of-concept information can be found in the Patchstack WordPress Plugin Advisory.

Detection Methods for CVE-2025-69379

Indicators of Compromise

• Unexpected HTTP requests to Upload Files Anywhere plugin endpoints containing ../ or URL-encoded path traversal sequences
• Missing critical WordPress files such as wp-config.php, .htaccess, or plugin/theme files
• Web server logs showing suspicious requests with directory traversal patterns targeting the wp-upload-files-anywhere plugin
• WordPress error messages indicating missing configuration or core files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal sequences (../, ..%2f, %2e%2e/)
• Monitor web server access logs for unusual patterns targeting the Upload Files Anywhere plugin endpoints
• Deploy file integrity monitoring to detect unauthorized deletion of WordPress core files
• Use WordPress security plugins to scan for vulnerable plugin versions and suspicious activity

Monitoring Recommendations

• Enable verbose logging on WordPress installations and review logs for path traversal attempts
• Configure alerting for deletion events on critical WordPress files and directories
• Implement real-time monitoring of plugin-related endpoints for anomalous request patterns
• Regularly audit installed WordPress plugins for known vulnerabilities and outdated versions

How to Mitigate CVE-2025-69379

Immediate Actions Required

• Deactivate and remove the Upload Files Anywhere plugin until a patched version is available
• Review server logs for any evidence of exploitation attempts
• Verify integrity of WordPress core files and restore any missing files from backups
• Implement WAF rules to block path traversal sequences at the network edge

Patch Information

At the time of publication, users should check the Patchstack WordPress Plugin Advisory for the latest patch status and remediation guidance. Update the Upload Files Anywhere plugin to a version greater than 2.8 when a security fix becomes available from the vendor.

Workarounds

• Disable or uninstall the Upload Files Anywhere plugin until a security patch is released
• Implement server-side input validation to reject requests containing path traversal sequences
• Restrict access to plugin endpoints through .htaccess rules or web server configuration
• Deploy a Web Application Firewall (WAF) with rules to detect and block directory traversal attacks

# Apache .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.%2f) [NC]
    RewriteRule .* - [F,L]
</IfModule>