Yoco Payments - Path Traversal (CVE-2025-13801)
Description
The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
psychologyCrowdSec Analysis
CVE-2025-13801 is a path traversal vulnerability in the Yoco Payments plugin for WordPress, affecting all versions up to and including 3.9.0. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting the file parameter, potentially exposing sensitive information such as configuration files, credentials, or other confidential data.
CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-13801 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Yoco Payments plugin by sending requests to endpoints like /wp-json/yoco/logs or using the rest_route=/yoco/logs parameter, manipulating the file parameter with path traversal sequences (e.g., ../../) to access sensitive files such as /etc/passwd.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-01-07 |
| Rule Released | 2026-05-06 |
| CrowdSec First Seen | 2026-06-26 |