CVE-2025-25163: High Path Traversal in A/B Image Optimizer

CVE-2025-25163 is a high severity (CVSS 7.5) path traversal flaw in the Plugin A/B Image Optimizer WordPress plugin, versions up to and including 3.3. It lets a caller download files from the server. Patchstack reports no official patch, so deactivate and remove the plugin or replace it with a maintained alternative.

What's affected

• Product: Plugin A/B Image Optimizer for WordPress (plugin folder images-optimizer), by Zach Swetz.
• Affected: all versions through 3.3.
• Fixed: Patchstack's entry says no official patch is available. Check the plugin page on WordPress.org for a newer release before assuming the status has changed.
• Privileges: Patchstack lists the required privilege as Subscriber, so a low privilege account is enough on sites that allow registration. The NVD vector shows no privileges required.
• Impact: arbitrary file download, such as configuration files that contain secrets.

How to check if you're exposed

Find out whether the plugin is installed and which version runs. With WP-CLI:

wp plugin list --name=images-optimizer --fields=name,status,version

Without WP-CLI, open the Plugins page in the dashboard and look for Plugin A/B Image Optimizer, or list the directory on the server.

ls wp-content/plugins | grep -i images-optimizer

If it is present at 3.3 or older, you are in range. Inactive plugin files can still be reachable by URL on some setups, so a deactivated copy is not a safe state. Review web server logs for requests to the plugin's folder that contain parent directory sequences or that ask for configuration files, and check whether your site allows open registration.

What to do now

1. Deactivate and delete the plugin. Image optimisation is easy to replace with a maintained plugin or with a server side tool.
2. Confirm the plugin directory is gone from wp-content/plugins, not just disabled.
3. If the site was exposed, rotate secrets that may have been readable, starting with database credentials and the keys and salts in wp-config.php.
4. Review your registration settings and remove accounts you do not recognise.
5. Add a web application firewall rule or hosting level protection that blocks traversal patterns while you clean up.
6. Turn on update notifications and keep a plugin inventory so abandoned plugins are caught early.

Why it matters

The weakness is path traversal. The plugin builds a file path from a request value and does not confine it to the folder it meant to serve. A caller can steer the path upward and read files elsewhere on the server.

• CWE-22 is improper limitation of a pathname to a restricted directory. A file path built from input can point outside the folder the developer meant to expose.

The impact depends on what the web user can read. On a typical WordPress host that includes wp-config.php, which holds the database credentials and the secret keys. Reading it can turn a file read bug into full site takeover. Patchstack's page also notes the plugin has no vulnerability disclosure program and no patch, which is a signal about maintainer activity. When a plugin has no fix and no active maintainer, removing it is usually the right call rather than waiting.

Try it yourself

Abandoned plugins are easy to miss. This demo shows continuous monitoring catching new advisories against software you already run.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Patchstack entry for A/B Image Optimizer

Last reviewed: 19 October 2026.