{"id":77120,"date":"2026-02-14T06:55:26","date_gmt":"2026-02-14T03:25:26","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-13681-bfg-tools-extension-zipper\/"},"modified":"2026-02-14T06:55:26","modified_gmt":"2026-02-14T03:25:26","slug":"cve-2025-13681-bfg-tools-extension-zipper","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-13681-bfg-tools-extension-zipper\/","title":{"rendered":"CVE-2025-13681 &#8211; BFG Tools \u2013 Extension Zipper"},"content":{"rendered":"<p>CVE ID : CVE-2025-13681<\/p>\n<p>Published :  Feb. 14, 2026, 3:25 a.m. | 1\u00a0hour, 4\u00a0minutes ago<\/p>\n<p>Description : The BFG Tools \u2013 Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files and directories outside the intended `\/wp-content\/plugins\/` directory, which can contain sensitive information such as wp-config.php.<\/p>\n<p>Severity: 0.0 | NA<\/p>\n<p>Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-13681 Published : Feb. 14, 2026, 3:25 a.m. | 1\u00a0hour, 4\u00a0minutes ago Description : The BFG Tools \u2013 Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-77120","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/77120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=77120"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/77120\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=77120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=77120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=77120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}