Description
WordPress 插件 Yoco Payments 在 3.8.8 及之前版本中存在路径穿越漏洞，相关接口在处理 file 参数时缺乏有效的安全过滤，未认证的攻击者可构造恶意路径读取服务器上的任意文件内容，从而造成敏感信息泄露。
WordPress Yoco Payments plugin /wp-json/yoco/logs 目录遍历漏洞（CVE-2025-13801）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.sentinelone.com/vulnerability-database/cve-2025-13801/
https://www.cve.org/CVERecord?id=CVE-2025-13801
https://github.com/advisories/GHSA-p4xw-96rj-wp46
https://atomicedge.io/cve-proof/cve-2025-13801-yoco-payment-gateway-version-3-9-0-high-vulnerability-proof-of-concept/
https://hackhalt.com/threat/cve-2025-13801/
https://s4e.io/tools/yoco-payments-path-traversal-cve-2025-13801
https://cve.akaoma.com/cve-2025-13801
https://2fsec.com/cve-2025-13801-analysis-of-unauthenticated-arbitrary-file-read-in-yoco-payments-3-8-8-wordpress-plugin/
https://vulners.com/nuclei/NUCLEI:CVE-2025-13801