CVE-2025-68002
Path Traversal in 100plugins Open User Map
Publication date: 2026-02-20
Last updated on: 2026-02-25
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 100plugins | open_user_map | From 1.0.0 (inc) to 1.4.16 (inc) |
| 100plugins | open_user_map | to 1.4.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68002 is a high-priority Arbitrary File Download vulnerability in the WordPress Open User Map Plugin versions up to and including 1.4.16.
This vulnerability arises from improper limitation of a pathname to a restricted directory, also known as a Path Traversal vulnerability.
It allows an attacker to download any file from the affected website, potentially exposing sensitive data.
The vulnerability is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS severity score of 6.5.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have serious impacts by allowing attackers to download arbitrary files from your website.'}, {'type': 'list_item', 'content': 'Exposure of sensitive data such as login credentials.'}, {'type': 'list_item', 'content': 'Exposure of backup files and other confidential information.'}, {'type': 'paragraph', 'content': 'Because the required privilege level to exploit this vulnerability is as low as a Subscriber or Developer, the risk of exploitation is high.'}, {'type': 'paragraph', 'content': "Successful exploitation can lead to data breaches and compromise of your website's security."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability allows an attacker to download arbitrary files from the affected WordPress Open User Map Plugin, which can be detected by monitoring for unusual HTTP requests attempting to access sensitive files or using path traversal patterns.'}, {'type': 'paragraph', 'content': 'While specific commands are not provided in the resources, typical detection methods include inspecting web server logs for suspicious requests containing path traversal sequences such as "../" or attempts to access files outside the intended directories.'}, {'type': 'paragraph', 'content': 'Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns to detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation step is to update the WordPress Open User Map Plugin to version 1.4.17 or later, where the vulnerability has been patched.
Until the update can be applied, users are advised to implement the mitigation rule provided by Patchstack to block attacks targeting this vulnerability.
Additionally, enabling automatic updates for vulnerable plugins can help enhance security and reduce the risk of exploitation.