CVE-2025-12960 is a directory traversal vulnerability (CWE-22) in the Simple CSV Table plugin for WordPress, affecting all versions up to 1.0.1. The issue arises from insufficient validation of the 'href' parameter in the [csv] shortcode, which is concatenated directly to a base directory path. Authenticated users with Contributor or higher privileges can exploit this to read arbitrary files on the server, potentially exposing sensitive data such as database credentials and authentication keys. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with network attack vector, low attack complexity, and requires privileges but no user interaction.

An attacker with Contributor-level or higher access can read arbitrary server files, potentially exposing sensitive information including database credentials and authentication keys. This can lead to information disclosure but does not directly impact integrity or availability. The medium CVSS score reflects the moderate risk due to required authentication and limited scope to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit Contributor-level access to trusted users only and monitor for suspicious activity involving the [csv] shortcode. Avoid using the vulnerable versions of the Simple CSV Table plugin if possible.