RSFirewall!, CVE-2025-7518

CVE, Research URL: CVE-2025-7518
Home page URL: Security reports for RSFirewall!
Application: RSFirewall!
Published on: Jul 12, 2025
Research Description: The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected versions: Min -, max 1.1.43.
Status: vulnerable