
- WordPress plugin flaw let low-privileged users access sensitive server files and credentials
- CVE-2025-11705 affects plugin versions 4.23.81 and earlier; patch released October 15
- About 50,000 sites remain vulnerable; admins urged to update immediately
A popular WordPress plugin with more than 100,000 active installations carried a bug that allowed threat actors to read any file on the server - including people’s emails and in some cases, passwords, too.