CVE-2025-46256 SigmaPlugin CVE debrief

Who should care

Defenders and security teams responsible for WordPress environments using the Advanced Database Cleaner PRO plugin should assess their exposure to this vulnerability. This includes administrators, security professionals, and anyone involved in maintaining or securing WordPress installations with this plugin.

Why it matters

CVE-2025-46256 is a Path Traversal vulnerability in the Advanced Database Cleaner PRO plugin, affecting versions from n/a through 3.2.10. Defenders should care because it could allow unauthorized file access or modification, disrupting database operations. They should verify exposure, prioritize updating to a secure version, and implement compensating controls if necessary. Evidence is limited, so verification from official sources is required.

• Potential unauthorized file access or modification
• Possible disruption of database operations
• Need for verification of plugin version and exposure
• Priority for updating to a secure plugin version

Technical summary

The Advanced Database Cleaner PRO plugin, used for database cleaning in WordPress environments, is vulnerable to a Path Traversal attack. This vulnerability, identified as CVE-2025-46256, allows attackers to potentially access or modify files outside the intended directory structure. The issue is rated with a CVSS score of 6.4, indicating a medium severity level. The vulnerability affects versions from n/a through 3.2.10 of the plugin.

Defensive priority

Defenders should prioritize verifying and updating to a secure version of the Advanced Database Cleaner PRO plugin, assessing exposure in their environments, and implementing compensating controls if necessary.

Recommended defensive actions

• Verify and update to a secure version of the Advanced Database Cleaner PRO plugin
• Assess exposure in environments using the affected plugin versions
• Implement compensating controls if necessary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, additional information on exploitation or specific impacts is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.