{“lastseen”:””,”description”:”The BFG Tools \u2013 Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files and directories outside the intended `\/wp-content\/plugins\/` directory, which can contain sensitive information such as wp-config.php.”,”published”:”2026-02-14T03:25:26.938Z”,”modified”:”2026-02-14T03:25:26.938Z”,”type”:”cve”,”title”:”BFG Tools \u2013 Extension Zipper \\u003c= 1.0.7 – Authenticated (Administrator+) Path Traversal via ‘first_file’ Parameter”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/5bd95df9-4355-4d57-ba44-59280463e284?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/bfg-tools-extension-zipper\/trunk\/bfg-tools-extension-zipper.php#L290\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/bfg-tools-extension-zipper\/tags\/1.0.7\/bfg-tools-extension-zipper.php#L290\\nhttps:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=\\u0026sfph_mail=\\u0026reponame=\\u0026old=3412948%40bfg-tools-extension-zipper\\u0026new=3412948%40bfg-tools-extension-zipper”,”id”:”CVE-2025-13681″,”bulletinFamily”:””,”cwe”:[“CWE-22″],”cvelist”:null,”sourceData”:”thebaldfatguy BFG Tools \u2013 Extension Zipper *”,”sourceHref”:””,”cvss”:{“score”:4.9,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”BFG Tools \u2013 Extension Zipper”,”version”:”*”,”vendor”:”thebaldfatguy”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The BFG Tools \u2013 Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,65,12,21,13,7,11,5],"class_list":["post-40851","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-49","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n