CVE-2025-14388: CWE-158 Improper Neutralization of Null Byte or NUL Character in kiboit PhastPress
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
AI Analysis
Technical Summary
The PhastPress plugin for WordPress suffers from an unauthenticated arbitrary file read vulnerability due to improper neutralization of null byte characters (CWE-158). The function getExtensionForURL() validates file extensions on URL-decoded paths, while appendNormalized() strips content after a null byte before building the filesystem path. Attackers can exploit this discrepancy by appending a double URL-encoded null byte (%2500) followed by an allowed extension (e.g., .txt) to read arbitrary files within the webroot, including sensitive configuration files like wp-config.php. This vulnerability affects all versions up to 3.7 and has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Potential Impact
Successful exploitation allows unauthenticated attackers to read arbitrary files on the web server hosting the vulnerable PhastPress plugin, potentially exposing sensitive information such as database credentials stored in wp-config.php. This can lead to full compromise of the WordPress installation and associated data confidentiality, integrity, and availability impacts as indicated by the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the PhastPress plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.
CVE-2025-14388: CWE-158 Improper Neutralization of Null Byte or NUL Character in kiboit PhastPress
Description
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The PhastPress plugin for WordPress suffers from an unauthenticated arbitrary file read vulnerability due to improper neutralization of null byte characters (CWE-158). The function getExtensionForURL() validates file extensions on URL-decoded paths, while appendNormalized() strips content after a null byte before building the filesystem path. Attackers can exploit this discrepancy by appending a double URL-encoded null byte (%2500) followed by an allowed extension (e.g., .txt) to read arbitrary files within the webroot, including sensitive configuration files like wp-config.php. This vulnerability affects all versions up to 3.7 and has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Potential Impact
Successful exploitation allows unauthenticated attackers to read arbitrary files on the web server hosting the vulnerable PhastPress plugin, potentially exposing sensitive information such as database credentials stored in wp-config.php. This can lead to full compromise of the WordPress installation and associated data confidentiality, integrity, and availability impacts as indicated by the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the PhastPress plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-12-09T20:27:24.165Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 694a62c0033f6f66d77784e1
Added to database: 12/23/2025, 9:37:04 AM
Last enriched: 4/9/2026, 9:49:55 AM
Last updated: 5/8/2026, 11:47:08 AM
Views: 321
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.