CVE-2025-13681 PUBLISHED

BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter

Assigner: Wordfence
Reserved: 25.11.2025 Published: 14.02.2026 Updated: 14.02.2026

The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied first_file parameter in the zip() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files and directories outside the intended /wp-content/plugins/ directory, which can contain sensitive information such as wp-config.php.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 4.9

Product Status

Vendor thebaldfatguy
Product BFG Tools – Extension Zipper
Versions Default: unaffected
  • affected from * to 1.0.7 (incl.)

Credits

  • Itthidej Aramsri finder

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE