CVE-2025-13801

Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read

Published Jan 7, 2026 CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Description

The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Analysis

Technical impact

The Yoco Payments WordPress plugin contains a path traversal flaw (CWE-22) in how it processes the file parameter. An attacker who can send a request to the plugin can craft a file name that points to any file on the server and cause the plugin to read and return its contents. This does not require any user authentication, so anyone on the public internet could potentially read configuration files, credentials, or other data that should remain confidential.

Affected Systems

All installations of the Yoco Payments plugin up to and including version 3.9.0 are affected. The plugin is distributed via the WordPress plugin repository and is used on sites that accept payments through WordPress.

Risk and Exploitability

The CVSS score of 7.5 places this vulnerability in the high‑risk category. An EPSS score of 2% indicates a low probability that attackers will target this flaw. Because the attack does not require authentication, the scope is limited to file contents of the web server, but the exposed data may be enough to facilitate additional attacks. The flaw is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

yocoadmin

Yoco Payments

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.9.0

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Yoco Payments to the latest version that removes the path traversal vulnerability.
If an upgrade cannot be performed immediately, block unauthenticated access to the plugin’s file‑handling endpoint with a web‑application firewall rule, .htaccess restriction, or WordPress REST API permission.
Alternatively, modify the plugin’s file‑reading code to validate that the file name matches a whitelist of legitimate files or remove the vulnerable code entirely.

Generated by OpenCVE AI on June 18, 2026 at 06:06 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.8% (1.825% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/yoco-payment-gateway/tags/3.8.8/src/Helpers/Logs.php#L25
https://plugins.trac.wordpress.org/browser/yoco-payment-gateway/tags/3.8.8/src/Helpers/Logs.php#L59
https://plugins.trac.wordpress.org/changeset/3434947/
https://www.wordfence.com/threat-intel/vulnerabilities/id/ad74d5d0-270e-41d3-9596-2f71b05af276?source=cve

History

Apr 8, 2026 6:30 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description	The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.8.8 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.	The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Title	Yoco Payments <= 3.8.8 - Unauthenticated Arbitrary File Read	Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
References		https://plugins.trac.wordpress.org/changeset/3434947/

Jan 8, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Jan 7, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 7, 2026 9:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.8.8 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Title		Yoco Payments <= 3.8.8 - Unauthenticated Arbitrary File Read
Weaknesses		CWE-22
References		https://plugins.trac.wordpress.org/browser/yoco-payment-gateway/tags/3.8.8/src/Helpers/Logs.php#L25 https://plugins.trac.wordpress.org/browser/yoco-payment-gateway/tags/3.8.8/src/Helpers/Logs.php#L59 https://www.wordfence.com/threat-intel/vulnerabilities/id/ad74d5d0-270e-41d3-9596-2f71b05af276?source=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`