Loading
Generated remediation guidance and an executive summary. No account required.
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
Use CWE-22, Benjaminrojas vendor hub and Wp Editor product page to widen CVE-2025-3294 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2016-10886, CVE-2016-10885 and CVE-2022-2446 for nearby disclosures in the same product family.