CVE-2025-69380: Upload Files Anywhere Path Traversal

CVE-2025-69380 Overview

CVE-2025-69380 is a Path Traversal vulnerability (CWE-22) affecting the Upload Files Anywhere WordPress plugin (wp-upload-files-anywhere) developed by vanquish. This vulnerability allows unauthenticated attackers to traverse directories and download arbitrary files from the server, potentially exposing sensitive configuration files, database credentials, and other protected data.

Critical Impact
Unauthenticated attackers can exploit this path traversal flaw to download arbitrary files from vulnerable WordPress installations, leading to sensitive data exposure including wp-config.php and other critical system files.

Affected Products

Upload Files Anywhere WordPress Plugin version 2.8 and earlier
WordPress installations with wp-upload-files-anywhere plugin enabled
All WordPress versions running the vulnerable plugin

Discovery Timeline

2026-02-20 - CVE CVE-2025-69380 published to NVD
2026-02-23 - Last updated in NVD database

Technical Details for CVE-2025-69380

Vulnerability Analysis

This path traversal vulnerability exists due to improper limitation of a pathname to a restricted directory in the Upload Files Anywhere WordPress plugin. The plugin fails to adequately sanitize user-supplied input when processing file download requests, allowing attackers to use directory traversal sequences (such as ../) to access files outside the intended upload directory.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. Successful exploitation results in unauthorized read access to sensitive files on the web server, though it does not allow file modification or system availability impact.

Root Cause

The root cause of CVE-2025-69380 is insufficient input validation and path canonicalization in the file download functionality of the Upload Files Anywhere plugin. The plugin does not properly validate or sanitize file path parameters before using them to retrieve files from the filesystem. This allows attackers to inject path traversal sequences that escape the intended directory boundary and access arbitrary files readable by the web server process.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can craft malicious HTTP requests containing directory traversal sequences (e.g., ../../../etc/passwd or ..\..\..\..\wp-config.php) to escape the intended upload directory and download arbitrary files from the server filesystem.

The vulnerability enables attackers to:

Download WordPress configuration files containing database credentials
Access backup files and sensitive application data
Retrieve server configuration files if readable by the web server
Exfiltrate user data and other sensitive information stored on the server

For technical details on the exploitation mechanism, refer to the Patchstack security advisory.

Detection Methods for CVE-2025-69380

Indicators of Compromise

HTTP requests to Upload Files Anywhere plugin endpoints containing ../ or ..\ sequences
Web server access logs showing requests for files outside the uploads directory
Unusual access patterns to wp-config.php or other sensitive configuration files
Error logs indicating attempted access to system files through the plugin

Detection Strategies

Implement web application firewall (WAF) rules to detect and block path traversal patterns in requests
Monitor HTTP requests to the wp-upload-files-anywhere plugin for directory traversal sequences
Enable WordPress debug logging to capture suspicious file access attempts
Deploy file integrity monitoring on critical WordPress and system configuration files

Monitoring Recommendations

Analyze web server access logs for requests containing encoded path traversal sequences (%2e%2e%2f, %252e%252e%252f)
Set up alerts for any access to sensitive files like wp-config.php through non-standard paths
Monitor for bulk download activity or unusual file access patterns from the plugin endpoints
Implement real-time log analysis for suspicious request patterns targeting the vulnerable plugin

How to Mitigate CVE-2025-69380

Immediate Actions Required

Disable or deactivate the Upload Files Anywhere plugin immediately if running version 2.8 or earlier
Review web server access logs for any indicators of prior exploitation
Audit and rotate credentials stored in wp-config.php as a precautionary measure
Consider removing the plugin entirely until a patched version is confirmed available

Patch Information

At the time of publication, users should verify with the plugin developer (vanquish) whether a patched version is available. Check the Patchstack advisory for the latest remediation guidance.

Until a patch is available, organizations should implement the workarounds described below to reduce risk.

Workarounds

Disable the Upload Files Anywhere plugin until a security update is released
Implement WAF rules to block requests containing path traversal patterns targeting the plugin
Restrict plugin functionality to authenticated users only via access control configurations
Use .htaccess rules to limit access to the plugin's file serving endpoints

bash

# Apache .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.) [NC]
    RewriteRule .* - [F,L]
</IfModule>