CVE-2025-52719
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Full Path Disclosure (FPD) issue in the WordPress ProfileGrid plugin up to version 5.9.5.2. It allows an attacker with subscriber-level privileges to obtain the full file system paths of folders or files on the server. This exposure of sensitive system information can be used to facilitate further attacks by revealing internal server structure. [1]
How can this vulnerability impact me? :
The vulnerability has a low severity impact on its own but can enable attackers to gather sensitive path information that may help them exploit other system weaknesses. While it does not directly cause severe damage, it can be a stepping stone for more serious attacks. Timely updates and incident response are recommended to mitigate risks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking if the ProfileGrid plugin version is 5.9.5.2 or earlier, as these versions are vulnerable. Additionally, monitoring for attempts to retrieve full file system paths via subscriber-level accounts may indicate exploitation. Specific commands are not provided in the resources, but verifying the plugin version via WordPress admin or command line and scanning server logs for suspicious requests targeting ProfileGrid endpoints is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the ProfileGrid plugin to version 5.9.5.3 or later, which contains the fix for this vulnerability. Alternatively, applying Patchstack's virtual patching (vPatching) can auto-mitigate the issue before official patches are applied. It is also recommended to perform professional incident response and server-side malware scanning if a compromise is suspected. [1]