CVE-2025-13070 — CSV to SortTable <= 4.2 - Contributor+ LFI

CVE-2025-13070

CSV to SortTable <= 4.2 - Contributor+ LFI PUBLISHED

Description (CNA)

The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / CSV to SortTable	affected 0 through 4.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/deb52d69-d7f8-43a5-a709-1f543fd343c6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.