CVE-2025-14388: Kiboit Phastpress

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.

Affected products

• Kiboit Phastpress: up to and including 3.7

Published 2025-12-23. Last modified 2026-06-17.