Skip to content
OpenAdvisories

Product · kiboit

PhastPress

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2025-14388

    PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection

    The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates …

    kiboit PhastPress Web / CMS