---
id: CVE-2025-8385
title: >-
  The Zombify plugin for WordPress is vulnerable to Path Traversal in all
  versions up to, and including, 1.7.5
summary: >-
  The Zombify plugin for WordPress is vulnerable to Path Traversal in all
  versions up to, and including, 1.7.5. This is due to insufficient input
  validation in the zf_get_file_by_url function. This makes it possible for
  authenticated attac…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-22
published: '2025-10-31'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8385'
references:
  - url: 'https://themeforest.net/item/boombox-viral-buzz-wordpress-theme/16596434'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9010e3-f060-4bef-b62b-4a648f5e5577?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00397
epssPercentile: 0.31814
ingestedAt: '2026-10-07T21:54:14.914Z'
---

## Overview

The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient input validation in the zf_get_file_by_url function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read arbitrary files on the server, including sensitive system files like /etc/passwd, via a forged request. It's worth noting that successfully exploiting this vulnerability relies on a race condition as the file generated will be deleted immediately.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.