VulnerabilityDeferred

CVE-2025-14829

The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation.

CRITICAL 9.1EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/872569bc-16fb-427f-accc-147f284137cd/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.