How severe is CVE-2025-2056?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.5 out of 10.

What type of vulnerability is CVE-2025-2056?

This is classified as CWE-23, which is a common weakness in software security.

CVE-2025-2056 - HIGH Severity | CVSS 7.5

Vulnerability Description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.

Related Vulnerabilities

CVE-2018-12473

HIGH

CVSS:7.5(High)

A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by ...

CWE-232018

CVE-2018-12476

HIGH

CVSS:7.5(High)

Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machi...

CWE-232018

CVE-2019-13408

HIGH

CVSS:7.5(High)

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without an...

CWE-232019

CVE-2020-17518

HIGH

CVSS:7.5(High)

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be w...

CWE-232020

CVE-2020-5280

HIGH

CVSS:7.5(High)

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server....

CWE-232020

CVE-2020-5410

HIGH

CVSS:7.5(High)

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-con...

CWE-232020