Medium · 6.5 CVE-2025-64235 EUVD-2025-204382GHSA-r4wm-hqf4-gm3g

WordPress Tuturn plugin < 3.6 - Arbitrary File Download vulnerability

Published Dec 18, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tuturn: from n/a before 3.6.

Affected products

Vendor	Product	Affected	Fixed
AmentoTech	Tuturn	< 3.6	3.6

References

https://patchstack.com/database/wordpress/plugin/tuturn/vulnerability/wordpress-tuturn-plugin-3-6-arbitrary-file-download-vulnerability?_s_id=cve vdb-entry