CVE-2025-14829 — e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion

CVE-2025-14829

e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion PUBLISHED

Description (CNA)

The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.

Affected (CNA)

Vendor / product	Versions
Unknown / E-xact \| Hosted Payment \|	affected 0 through 2.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/872569bc-16fb-427f-accc-147f284137cd/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.