Description
PhastPress 插件（WordPress 版本 3.7 及以下）存在未经身份验证的任意文件读取漏洞。该漏洞源于 getExtensionForURL() 和 appendNormalized() 函数之间的验证不一致。攻击者可以利用 null 字节注入漏洞，在文件路径后添加双重 URL 编码的 null 字节（%2500）和允许的扩展名（如 .txt），从而绕过文件扩展名验证，读取 web 根目录中的任意文件，如 wp-config.php 等敏感文件。
WordPress PhastPress plugin /wp-content/plugins/phastpress/phast.php 文件读取漏洞（CVE-2025-14388）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-14388
https://cve.imfht.com/detail/CVE-2025-14388
https://www.sentinelone.com/vulnerability-database/cve-2025-14388/
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/phastpress
https://wp-firewall.com/zh_cn/phastpress-arbitrary-file-download-vulnerability-alert-published-on-2025-12-24-cve-2025-14388/
https://managed-wp.com/zh_cn/blogs/mitigating-arbitrary-file-download-in-phastpress-cve202514388-2025-12-26/
https://radar.offseq.com/threat/cve-2025-14388-cwe-158-improper-neutralization-of--469918d2
https://cve.circl.lu/vuln/CVE-2025-14388
https://access.redhat.com/security/cve/cve-2025-14388
https://www.thehackerwire.com/critical-unauthenticated-file-read-in-phastpress-wordpress-plugin-null-byte-injection-exposes-sensitive-data/