{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1911", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-03T22:18:14.606Z", "datePublished": "2025-03-26T11:55:52.549Z", "dateUpdated": "2026-04-08T17:25:17.118Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:17.118Z"}, "affected": [{"vendor": "webtoffee", "product": "Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server."}], "title": "Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d222ef6d-cdec-482e-92ba-65eeabbcdeae?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L248"}, {"url": "https://wordpress.org/plugins/product-import-export-for-woo/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3261194/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.7, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "Hay Mizrachi"}], "timeline": [{"time": "2025-03-25T23:22:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T13:14:04.436225Z", "id": "CVE-2025-1911", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T13:18:52.969Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T13:14:04.436225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T13:14:12.263Z"}}], "cna": {"title": "Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function", "credits": [{"lang": "en", "type": "finder", "value": "Hay Mizrachi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "webtoffee", "product": "Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-25T23:22:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d222ef6d-cdec-482e-92ba-65eeabbcdeae?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L248"}, {"url": "https://wordpress.org/plugins/product-import-export-for-woo/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3261194/"}], "descriptions": [{"lang": "en", "value": "The Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:17.118Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1911", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:25:17.118Z", "dateReserved": "2025-03-03T22:18:14.606Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-26T11:55:52.549Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "20BB9A46-07D4-49F8-B399-8B34D8658A4B", "versionEndExcluding": "2.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server."}, {"lang": "es", "value": "El complemento Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite para WordPress es vulnerable a la eliminaci\u00f3n arbitraria de archivos debido a una validaci\u00f3n insuficiente de la ruta de archivo en la funci\u00f3n admin_log_page() en todas las versiones hasta la 2.5.0 incluida. Esto permite que atacantes autenticados, con acceso de administrador o superior, eliminen archivos de registro arbitrarios en el servidor."}], "id": "CVE-2025-1911", "lastModified": "2025-07-09T16:55:18.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-26T12:15:15.197", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L248"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3261194/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/product-import-export-for-woo/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d222ef6d-cdec-482e-92ba-65eeabbcdeae?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:28:01.205385+00:00", "value": {"mitigation_remediation": ["Upgrade the Product Import Export for WooCommerce plugin to the latest version, which removes the directory traversal flaw.", "If an upgrade cannot be performed immediately, disable or remove the admin_log_page feature that permits file deletion or modify the plugin code to enforce strict path validation.", "Adjust file system permissions on log directories so that non-essential accounts cannot delete logs, ensuring that only authorized services retain write access."], "summary": {"action": "Patch", "impact": "Arbitrary deletion of log files by administrators"}, "threat_synthesis": {"affected_systems": "The flaw affects the webtoffee Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite plugin for WordPress, any version 2.5.0 or earlier. The plugin is installed on WordPress sites and is identified as webtoffee:product_import_export_for_woocommerce in the CPE registry.", "description_and_impact": "A directory traversal flaw in the admin_log_page() function of the Product Import Export for WooCommerce plugin allows an attacker who holds Administrator privileges in WordPress to delete arbitrary log files on the server. The vulnerability does not grant code execution or data exfiltration, but it removes audit trail information, potentially reducing the ability to investigate incidents or debug the system. Because the affected function operates on paths supplied by the user, the attacker can target any file that the web server process can write to, which may include security or access logs.", "risk_and_exploitability": "With a CVSS score of 2.7 the vulnerability is considered a low severity issue, and its EPSS score is below 1%, indicating a very low likelihood of exploitation. The exploit requires an authenticated user with Administrator level or higher privileges; thus, a local attacker who can log into the WordPress admin interface is sufficient to trigger the deletion. The vulnerability is not listed in the CISA KEV catalog, so no widely known exploits are published at the time of this analysis."}}}}, "created": "2026-04-20T23:30:16.125040+00:00", "updated": "2026-04-20T23:30:16.125051+00:00", "vendors": []}