CVE-2025-12960

The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[csv]` shortcode. This is due to insufficient path validation before concatenating user-supplied input to a base directory path. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.

• CWE-22

• https://plugins.trac.wordpress.org/browser/simple-csv-table/tags/1.0.1/simple-csv-table.php#L71
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3403210%40simple-csv-table&new=3403210%40simple-csv-table&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff9abb4-2b25-4bbb-86b4-fb1ba37e122f?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12954The Timetable and Event Schedule by MotoPress WordPress plug…2.7
• CVE-2025-12955The Live sales notification for WooCommerce plugin for WordP…7.5
• CVE-2025-12956A reflected Cross-site Scripting (XSS) vulnerability affecti…5.4
• CVE-2025-12957The All-in-One Video Gallery plugin for WordPress is vulnera…8.8
• CVE-2025-12958The Rankology SEO and Analytics Tool plugin for WordPress is…2.7
• CVE-2025-1296Nomad Community and Nomad Enterprise (“Nomad”) are vulnerabl…6.5
• CVE-2025-12961The Download Panel plugin for WordPress is vulnerable to una…4.3
• CVE-2025-12962The Local Syndication plugin for WordPress is vulnerable to …6.4
• CVE-2025-12963The LazyTasks – Project & Task Management with Collaboration…9.8
• CVE-2025-12964The Magical Products Display plugin for WordPress is vulnera…6.4
• CVE-2025-12965The Magical Posts Display plugin for WordPress is vulnerable…6.4
• CVE-2025-12966The All-in-One Video Gallery plugin for WordPress is vulnera…8.8