CVE-2025-39544: WordPress WP Tools plugin <= 5.18 - CSRF to Arbitrary File Deletion vulnerability

Q: What is the severity of CVE-2025-39544?

CVE-2025-39544 is classified as a moderate severity Cross-Site Request Forgery (CSRF) vulnerability.

Q: How do I fix CVE-2025-39544?

To fix CVE-2025-39544, update the WP Tools plugin to version 5.19 or later.

Q: Which versions of WP Tools are affected by CVE-2025-39544?

CVE-2025-39544 affects WP Tools versions up to and including 5.18.

Q: What are the potential impacts of CVE-2025-39544?

Exploitation of CVE-2025-39544 could allow an attacker to perform unauthorized actions on behalf of authenticated users.

Q: Is CVE-2025-39544 specific to any CMS?

Yes, CVE-2025-39544 is specific to the WordPress plugin WP Tools developed by Bill Minozzi.

Published Apr 16, 2025

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi WP Tools allows Path Traversal. This issue affects WP Tools: from n/a through 5.18.

Other sources

Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Path Traversal.This issue affects WP Tools: from n/a through <= 5.18.

— MITRE

Affected Software

1 affected component

Bill Minozzi WP Tools<=5.18

Remediation

Information

Update the WordPress WP Tools plugin to the latest available version (at least 5.19).

Event History

Apr 16, 2025

CVE Published

via MITRE·12:44 PM

Data Sourced

via MITRE·12:44 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-39544?

CVE-2025-39544 is classified as a moderate severity Cross-Site Request Forgery (CSRF) vulnerability.

How do I fix CVE-2025-39544?

To fix CVE-2025-39544, update the WP Tools plugin to version 5.19 or later.

Which versions of WP Tools are affected by CVE-2025-39544?