CVE-2025-13677

The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which may contain sensitive information such as database credentials (wp-config.php) or system files. Please note that the vendor opted to continue to allow remote file downloads from arbitrary locations on the server, however, has disabled this functionality on multi-sites and provided a warning to site owners in the readme.txt when they install the plugin. While not an optimal patch, we have considered this sufficient and recommend users proceed to use the plugin with caution.

• CWE-22

• https://plugins.trac.wordpress.org/browser/simple-download-counter/tags/2.2.2/inc/functions-admin.php#L566
• https://plugins.trac.wordpress.org/browser/simple-download-counter/trunk/inc/functions-admin.php#L566
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3409876%40simple-download-counter&new=3409876%40simple-download-counter&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b82a0f71-29d7-469a-8c69-5ab68d599cb9?source=cve

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13671Cross-Site Request Forgery (CSRF) vulnerability in OpenText™…6.5
• CVE-2025-13672Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2025-13673The Tutor LMS – eLearning and online course solution plugin …7.5
• CVE-2025-13674BPv7 dissector crash in Wireshark 4.6.0 allows denial of ser…5.5
• CVE-2025-13675The Tiger theme for WordPress is vulnerable to Privilege Esc…9.8
• CVE-2025-13676The JustClick registration plugin for WordPress is vulnerabl…6.1
• CVE-2025-13678The Thai Lottery Widget plugin for WordPress is vulnerable t…6.4
• CVE-2025-13679The Tutor LMS – eLearning and online course solution plugin …6.5
• CVE-2025-1368A vulnerability was found in MicroWord eScan Antivirus 7.0.3…4.6
• CVE-2025-13680The Tiger theme for WordPress is vulnerable to Privilege Esc…8.8
• CVE-2025-13681The BFG Tools – Extension Zipper plugin for WordPress is vul…4.9
• CVE-2025-13682The Trail Manager plugin for WordPress is vulnerable to Stor…4.4