CVE-2025-26534 HIGH

CVE-2025-26534: WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability

Vendor Helloprint
Product Helloprint
Weakness CWE-22 · Path traversal
Published March 3, 2025
Last update April 28, 2026

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.

Explanation of Vulnerability in Simple Terms

02Summary

Helloprint versions up to 2.0.7 contain a path traversal vulnerability that allows an attacker to cause a denial of service by sending specially crafted network requests. No authentication is required. The vulnerability affects the availability of the application across multiple systems or services.

What an attacker can do

03Attacker Capabilities

Make the application unavailable by sending malicious requests that exploit path traversal.

Potential impact on your site

04Site Impact

Your Helloprint service may become unavailable or unresponsive to legitimate users.

Conditions required to exploit

05Prerequisites

Network access to the Helloprint application; no authentication or user interaction required.

Key dates

06Disclosure timeline

March 3, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE