CVE-2025-48267 is a high severity path traversal flaw (CVSS 8.6) in WP Pipes, a WordPress plugin from ThimPress. It affects versions up to and including 1.4.2. A Patchstack page listed in the record describes it as arbitrary file deletion. No fixed version is named, so update and read the changelog.
What's affected
Per the CVE record, WP Pipes from ThimPress (plugin slug wp-pipes) is affected in versions from n/a through 1.4.2. Every release up to and including 1.4.2 is in scope.
The record describes improper limitation of a pathname to a restricted directory. It is filed under CWE-22 (Path Traversal). The only reference is a Patchstack database entry, and the address of that page describes the issue as an arbitrary file deletion vulnerability. The NVD text itself does not say what the path is used for, so treat the file deletion description as coming from that page and not from the record body.
The base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. It is network reachable with no privileges and no interaction. Confidentiality and integrity are untouched, availability impact is high, and the scope is changed, which fits a flaw that deletes files and affects more than the plugin itself.
No fixed version is named in the record. Confirm it in the plugin changelog.
How to check if you're exposed
Plugins are listed with their versions in the WordPress admin under Plugins. From the command line, with WP-CLI:
wp plugin list --name=wp-pipes --fields=name,version,status
Run it on every site you manage, including staging copies and sites that are not actively edited. A plugin that is installed but inactive is still on disk, and some flaws can be reached whether or not the plugin is switched on, so remove plugins you do not use.
Then compare the version you see with the affected range above. If you manage many sites, a plugin inventory from your management tool or a dependency scan will save time.
What to do now
- Update WP Pipes to the newest release and read the changelog for the entry covering this issue.
- If you do not use the plugin, deactivate and delete it.
- Take a full backup of files and the database before the update, and keep it somewhere the web server cannot write to.
- Check that
wp-config.phpand other core files are not writable by the web server user, so the damage from a file deletion flaw is limited. - Review web logs for unusual requests to the plugin paths, and check for missing files in the site.
- Make sure you can restore a site from backup quickly, since the main effect described is loss of availability.
Why it matters
Path traversal is a simple idea. A program is given part of a file path and joins it onto a folder, trusting that the result stays inside that folder. If the input can step up and out of the folder, the program may reach files elsewhere on the server. What happens next depends on the function: it might read a file, write one, or, as the Patchstack page suggests here, delete one.
Deleting the right file can take a whole site down. On WordPress, removing a key configuration file can send the site back to its installation screen. This is why the vector shows a high availability impact even though no data is read.
It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. The sturdy fixes are to resolve the final path and check that it still sits inside the intended folder, and to allow only a fixed list of names.
Quick check
Why does the score say high availability impact only?
Because the weakness described is file deletion. Nothing is read or changed according to the vector, but losing files can take the site offline.
Is there a fixed version?
The record does not name one. Update to the newest release and read the plugin changelog.
Sources
Last reviewed: 18 October 2026.
