CVE-2025-14388

The record

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.

Affected packages

Related vulnerabilities

• CVE-2026-76354 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-158
• CVE-2026-47778 Envoy is an open source edge and service proxy designed for cloud-native applications. CWE-158
• CVE-2026-43895 jq is a command-line JSON processor. CWE-158
• CVE-2026-41256 jq is a command-line JSON processor. CWE-158
• CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… CWE-158
• CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. CWE-158
• CVE-2026-23863 An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709… CWE-158
• CVE-2026-33191 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-158