Vulnerability · Published Dec 9, 2025 · Assigned by WPScan
CVE-2025-13070CSV to SortTable <= 4.2 - Contributor+ LFI
Medium 6.6
In plain English
A medium-severity path traversal in CSV to SortTable from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.4%top 61.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | CSV to SortTable | 0 – through 4.2 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/deb52d69-d7f8-43a5-a709-1f543fd343c6/ exploit, vdb-entry, technical-description