CVE-2025-49415
BaseFortify
Publication date: 2025-06-17
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Path Traversal issue in the Fastw3b FW Gallery WordPress plugin (up to version 8.0.0) that allows unauthenticated attackers to delete arbitrary files on a website. This means attackers can exploit the plugin to remove critical files, potentially disrupting site functionality. It is classified as a high-severity arbitrary file deletion vulnerability with a CVSS score of 8.6. [1]
How can this vulnerability impact me? :
The vulnerability can lead to critical failures of your website if important files are deleted by attackers. Since it allows unauthenticated arbitrary file deletion, attackers can cause denial of service or disrupt site operations by removing core files, potentially resulting in downtime or loss of data integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for exploitation attempts targeting the FW Gallery plugin, such as unusual HTTP requests attempting arbitrary file deletion. Since there is no official patch, using virtual patching tools like Patchstack's vPatch can help detect and block exploitation attempts. Specific commands are not provided in the resources, but monitoring web server logs for suspicious requests to the FW Gallery plugin endpoints and using intrusion detection systems with signatures for this vulnerability is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the virtual patch (vPatch) provided by Patchstack to block exploitation attempts until an official fix is released. Users should promptly implement these mitigations and consider professional incident response if compromise is suspected. Additionally, monitoring and restricting access to the FW Gallery plugin can reduce risk. [1]