CVE-2025-13070 in CSV to SortTable Plugin
Sumário (Inglês)
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
Responsável
WPScan
Reservar
12/11/2025
Divulgação
09/12/2025
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 334936 | CSV to SortTable Plugin Shortcode Travessia de Diretório | 22 | Não definido | Não definido | CVE-2025-13070 |