CVE-2025-14388 | The PhastPress plugin for WordPress is vulnerable to Unauthe… | CVSS 9.8 CRITICAL

Description

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.

Metadata

CVE ID: CVE-2025-14388
State: PUBLISHED
Assigner: Wordfence
Reserved: 2025-12-09 20:27 UTC
Published: 2025-12-23 09:20 UTC
Last updated: 2026-04-08 17:31 UTC
Primary CWE: CWE-158
CWE-158 Improper Neutralization of Null Byte or NUL Characte…
Vendor / Product: kiboit / PhastPress
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
kiboit	PhastPress	—	0 ≤ 3.7

Weakness (CWE)

CWE	Source	Description
CWE-158	cna	CWE-158 Improper Neutralization of Null Byte or NUL Character

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)