Description
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
INFO
Published Date :
2025-12-23T09:20:03.420Z
Last Modified :
2026-04-08T17:31:49.693Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2025-14388 vulnerability.
| Vendors | Products |
|---|---|
| Kiboit |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-14388.
