CVE-2025-13070

The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.

CVSS v3.1

6.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.44% chance of exploitation in the next 30 days, 36th percentile

Published

2025-12-09

Updated

2026-04-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/deb52d69-d7f8-43a5-a709-1f543fd343c6/

References

• CVE Record
• NVD entry

Related

• CVE-2025-1307
• CVE-2025-13071
• CVE-2025-13063
• CVE-2025-13072
• CVE-2025-13061
• CVE-2025-13073