CVE-2025-1730
Last modified
CVE-2025-1730 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counter_download_handler'. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including any local file on the server, such as wp-config.php or /etc/passwd.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counter_download_handler'. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including any local file on the server, such as wp-config.php or /etc/passwd.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-1730?
How severe is CVE-2025-1730?
How do I fix CVE-2025-1730?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-1724Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on…7.4
- CVE-2025-1725The Bit File Manager – 100% Free & Open Source File Manager …6.4
- CVE-2025-1726There is a SQL injection issue in Esri ArcGIS Monitor versio…4.3
- CVE-2025-1727The protocol used for remote linking over RF for End-of-Trai…8.1
- CVE-2025-1728Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2025-1729A DLL hijacking vulnerability was reported in TrackPoint Qui…6.7
- CVE-2025-1731An incorrect permission assignment vulnerability in the Post…7.8
- CVE-2025-1732An improper privilege management vulnerability in the recove…6.7
- CVE-2025-1734In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f…5.3
- CVE-2025-1735In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.…7.5
- CVE-2025-1736In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f…7.3
- CVE-2025-1737Rejected reason: This CVE ID has been rejected or withdrawn …
Are you affected by CVE-2025-1730?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST