CVE-2025-13972

Name of the Vulnerable Software and Affected Versions WatchTowerHQ plugin for WordPress versions prior to 3.16.1

Description Insufficient path validation in the handle big object download request() function allows authenticated attackers with administrator-level access and a valid access token to read arbitrary files on the server. This is achieved via the wht download big object origin parameter, potentially exposing sensitive data such as authentication keys and database credentials.

Recommendations Update the plugin to a version newer than 3.16.0. As a temporary mitigation, restrict access to the handle big object download request() function.