CVE-2025-14388 — PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a disc…
Published: 2025-12-23 · CVSS: 9.8 · CVSS 3.1
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7