Vulnerabilities

TI-2025-12768 CVE-2025-13972 · GHSA-58q3-hw27-275g

Path traversal in WhatArmy WatchTowerHQ

LOW 23

The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00513 Published 2025-12-12 No fix listed CWE-22

TI-2024-09217 CVE-2024-9933 · GHSA-5vxh-frxx-px6f

WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check

MEDIUM 53

The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.10.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0199 Published 2024-10-26 No fix listed CWE-288

TI-2023-10977 CVE-2023-25701 · GHSA-grw4-fg3f-pfjq

WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege Escalation

MEDIUM 44

Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00805 Published 2024-05-17 No fix listed CWE-269

TI-2022-21920 CVE-2022-44583 · GHSA-27q2-f36g-hmv6

WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability

MEDIUM 40

Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00804 Published 2022-11-18 No fix listed CWE-552

TI-2022-21921 CVE-2022-44584 · GHSA-f8q5-rrg5-h693

WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability

MEDIUM 47

Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00909 Published 2022-11-18 No fix listed