CVE-2025-25163

HIGH

Zach Swetz Plugin A/B Image Optimizer <3.3 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-25163. PoCs published by RootHarpy, RandomRobbieBF.

AI-analyzed exploit summary This repository contains a Nuclei template designed to detect the path traversal vulnerability (CVE-2025-25163) in the Plugin A/B Image Optimizer for WordPress. The template attempts to exploit the vulnerability by targeting the `/etc/passwd` file.

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through <= 3.3.

Exploits (2)

nomisec SCANNER 1 stars
by RootHarpy · poc
https://github.com/RootHarpy/CVE-2025-25163-Nuclei-Template

This repository contains a Nuclei template designed to detect the path traversal vulnerability (CVE-2025-25163) in the Plugin A/B Image Optimizer for WordPress. The template attempts to exploit the vulnerability by targeting the `/etc/passwd` file.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Plugin A/B Image Optimizer for WordPress (versions up to and including 3.3)
No auth needed
Prerequisites: Nuclei installed · Target URL with vulnerable plugin
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2025-25163

This PoC demonstrates an authenticated arbitrary file download vulnerability in the Plugin A/B Image Optimizer for WordPress, allowing attackers with Subscriber-level access to read sensitive files via directory traversal.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Plugin A/B Image Optimizer <= 3.3
Auth required
Prerequisites: WordPress installation with vulnerable plugin · Subscriber-level or higher authentication
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0188
EPSS Percentile 76.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
pluginab/plugin_a\/b_image_optimizer < 3.3
Zach Swetz/Plugin A/B Image Optimizer < 3.3
Published Feb 07, 2025
Tracked Since Feb 18, 2026