Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2025-6082 EUVD-2025-22302GHSA-ccxj-rx8f-h8x3

Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure

Published Jul 22, 2025 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: mia4 Product: Birth Chart Compatibility Category: Web / CMS

Description

The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.

Affected products

VendorProductAffectedFixed
mia4 Birth Chart Compatibility ≤ 2.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

  • byteReaper77/CVE-2025-6082 ★ 1 · Jul 22, 2025

    Proof‑of‑Concept exploits the Full Path Disclosure bug in the “Birth Chart Compatibility” WordPress plugin (<=v2.0)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References