CVE-2025-13801 identifies a path traversal vulnerability (CWE-22) in the Yoco Payments plugin for WordPress, affecting all versions up to and including 3.8.8. The vulnerability arises from improper validation and limitation of the 'file' parameter, which attackers can manipulate to traverse directories and access arbitrary files on the hosting server. This flaw allows unauthenticated remote attackers to read sensitive files without any user interaction, posing a direct threat to the confidentiality of data stored on the server. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting its high severity due to network exploitability, lack of required privileges, and high impact on confidentiality. Although no public exploits have been reported yet, the ease of exploitation and potential exposure of sensitive information such as configuration files, credentials, or payment data make this a critical issue for affected sites. The vulnerability is particularly concerning for WordPress sites using the Yoco Payments plugin to handle financial transactions, as attackers could leverage exposed data for further attacks or fraud. The absence of a patch at the time of reporting necessitates immediate risk mitigation through access controls and monitoring.

For European organizations, this vulnerability could lead to unauthorized disclosure of sensitive information including payment credentials, personal customer data, and internal configuration files. This exposure can result in financial fraud, regulatory non-compliance (e.g., GDPR violations), reputational damage, and potential downstream attacks leveraging stolen data. E-commerce platforms and financial service providers using the Yoco Payments plugin are especially vulnerable. The breach of confidentiality could disrupt business operations and erode customer trust. Given the widespread use of WordPress in Europe and the critical role of payment plugins in online commerce, the impact could be significant across multiple sectors including retail, finance, and services. Organizations may face legal and financial penalties if they fail to protect customer data adequately.

1. Monitor for and apply official patches or updates from the Yoco Payments plugin vendor as soon as they become available. 2. Until patched, restrict file system permissions on the web server to limit access to sensitive files and directories, ensuring the web server user has minimal privileges. 3. Implement web application firewalls (WAFs) with rules to detect and block path traversal attempts targeting the 'file' parameter. 4. Conduct regular security audits and vulnerability scans focusing on WordPress plugins and configurations. 5. Disable or remove the Yoco Payments plugin if it is not essential or replace it with a more secure alternative. 6. Employ logging and monitoring to detect unusual file access patterns that may indicate exploitation attempts. 7. Educate site administrators on secure plugin management and the risks of outdated components. 8. Use security plugins that can sandbox or restrict plugin behavior to reduce attack surface.