CVE-2025-13070 in CSV to SortTable Plugin
Résumé (Anglaise)
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
Responsable
WPScan
Réserver
12/11/2025
Divulgation
09/12/2025
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 334936 | CSV to SortTable Plugin Shortcode directory traversal | 22 | Non défini | Non défini | CVE-2025-13070 |