CVE-2025-9950: Error Log Viewer Path Traversal Vulnerability

CVE-2025-9950 Overview

CVE-2025-9950 is a directory traversal vulnerability in the Error Log Viewer by BestWebSoft plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.6 and resides in the rrrlgvwr_get_file function. Authenticated attackers with Administrator-level access or higher can supply crafted file paths to read arbitrary files on the underlying server. Readable targets include wp-config.php, system configuration files, and credential stores, which may expose database credentials, authentication keys, and other sensitive data. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Administrator-authenticated attackers can read arbitrary files on the WordPress server, enabling theft of wp-config.php secrets and lateral movement into the underlying host.

Affected Products

Error Log Viewer by BestWebSoft for WordPress — all versions up to and including 1.1.6
WordPress sites with the plugin installed and active
Multi-site WordPress deployments where administrators are delegated across tenants

Discovery Timeline

2025-10-11 - CVE-2025-9950 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9950

Vulnerability Analysis

The vulnerability lives in the rrrlgvwr_get_file function of the Error Log Viewer by BestWebSoft plugin. The function accepts a file path parameter and reads the referenced file to render log contents in the administrator interface. Input is not constrained to the plugin's expected log directory, so path traversal sequences such as ../ resolve outside that boundary. As a result, an authenticated administrator request can retrieve any file readable by the PHP process, including /etc/passwd, Apache or Nginx configuration files, and WordPress secrets stored in wp-config.php.

Exploitation requires an authenticated session at the Administrator role or higher. The attack is network-reachable through the standard WordPress admin interface and requires no user interaction. While the vulnerability does not directly affect integrity or availability, the disclosed material frequently enables follow-on compromise, including database access or privilege escalation on the host.

Root Cause

The root cause is missing validation and canonicalization of the file path argument supplied to rrrlgvwr_get_file. The plugin trusts administrator-supplied input and does not verify that the resolved path remains within the designated log directory before passing it to a file read primitive. Traversal metacharacters are therefore honored by the filesystem layer.

Attack Vector

An attacker with a valid administrator session issues a crafted request to the plugin endpoint, substituting the expected log file reference with a traversal payload such as ../../../../wp-config.php. The server returns the file contents in the response rendering path. The flaw is relevant in environments where lower-trust users hold administrator roles, where credentials have been phished, or where a chained vulnerability yields administrator-equivalent access.

For technical details, see the WordPress Error Log Viewer source at line 118, the upstream changeset, and the Wordfence vulnerability report.

Detection Methods for CVE-2025-9950

Indicators of Compromise

Web server access logs containing requests to Error Log Viewer admin endpoints with ../ or URL-encoded %2e%2e%2f sequences in parameters.
Administrator-session requests referencing files outside the plugin's log directory, such as wp-config.php, /etc/passwd, or .env files.
Unexpected read access on sensitive files by the PHP-FPM or web server process user following administrator activity.

Detection Strategies

Inspect WordPress admin HTTP request logs for parameters passed to the Error Log Viewer plugin that contain traversal patterns or absolute paths.
Correlate administrator authentications with subsequent plugin-driven file read operations and alert on paths outside the plugin install directory.
Run plugin inventory checks across WordPress fleets to flag any installation of Error Log Viewer by BestWebSoft at version 1.1.6 or earlier.

Monitoring Recommendations

Enable WordPress audit logging to capture administrator activity and plugin parameter values for retrospective review.
Forward web server and PHP error logs to a centralized analytics platform and build detections for path traversal signatures against plugin endpoints.
Monitor filesystem access to wp-config.php and other secret-bearing files, alerting on any read by the web user outside normal application flows.

How to Mitigate CVE-2025-9950

Immediate Actions Required

Update the Error Log Viewer by BestWebSoft plugin to a version later than 1.1.6 as soon as a patched release is available from the vendor.
Deactivate and remove the plugin on affected WordPress sites until a fixed version is installed.
Rotate WordPress secrets in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and salts) and database credentials if administrator access cannot be fully attested as uncompromised.
Review administrator accounts, revoke unused roles, and enforce multi-factor authentication for all Administrator-level users.

Patch Information

Refer to the upstream WordPress plugin changeset and the Wordfence advisory for the latest fixed version information. Apply vendor updates through the WordPress plugin manager or WP-CLI once a patched release is published.

Workarounds

Remove or disable the Error Log Viewer by BestWebSoft plugin until a patched version is applied.
Restrict Administrator role assignment to a minimal set of accounts and enforce strong authentication, limiting the attacker population able to reach the vulnerable function.
Deploy a web application firewall rule to block requests to Error Log Viewer endpoints containing ../, ..%2f, or absolute path references.
Enforce filesystem permissions so the PHP process cannot read sensitive host files outside the WordPress document root where feasible.

bash

# Update or remove the vulnerable plugin via WP-CLI
wp plugin update error-log-viewer

# If no patched version is yet available, deactivate and remove
wp plugin deactivate error-log-viewer
wp plugin uninstall error-log-viewer

# Audit administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered