CVE-2025-6381
High
Description
The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
SeverityHigh
CVSS8.8
Exploit probability—
ProductBeeteam368 Vidmov
PublishedJun 28, 2025
First seenJun 28, 2025
Weakness typeCWE-36CWE-36
How to fix
Update
- beeteam368 vidmov2.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| beeteam368 vidmov | v < 2.3.5 | 2.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.