CVE-2025-12089: WordPress Data Tables Plugin File Deletion

CVE-2025-12089 Overview

CVE-2025-12089 is an arbitrary file deletion vulnerability in the Data Tables Generator by Supsystic plugin for WordPress. The flaw exists in the cleanCache() function, which fails to properly validate file paths before deletion. All versions up to and including 1.10.45 are affected.

Authenticated attackers with Administrator-level access or above can delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to remote code execution by forcing WordPress into setup mode and allowing attacker-controlled database configuration. The weakness is categorized under [CWE-22] (Path Traversal).

Critical Impact
Authenticated administrators can delete any file accessible to the web server process, enabling site takeover through wp-config.php deletion and subsequent remote code execution.

Affected Products

Data Tables Generator by Supsystic plugin for WordPress
All versions up to and including 1.10.45
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2025-11-13 - CVE-2025-12089 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-12089

Vulnerability Analysis

The vulnerability resides in the cleanCache() function of the Data Tables Generator by Supsystic plugin. The function accepts a user-supplied file path and passes it to a file deletion routine without sufficient validation or sanitization. An attacker can submit a path containing directory traversal sequences such as ../ to escape the intended cache directory.

Because the plugin exposes this function to authenticated users with Administrator capability, exploitation requires existing high-privilege credentials. However, administrators on multi-admin WordPress installations, compromised credentials, or multisite environments represent realistic attack scenarios. Deleting wp-config.php triggers the WordPress installation flow on the next request, allowing an attacker to connect the site to a database they control and achieve code execution through plugin or theme uploads.

Root Cause

The cleanCache() function lacks path canonicalization and whitelist validation. It does not restrict deletion operations to the plugin's own cache directory, and it does not strip or reject traversal sequences in the input parameter. This classic [CWE-22] pattern allows filesystem operations to escape the intended boundary.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. The attacker issues a crafted request to the plugin's AJAX endpoint that invokes cleanCache(), supplying a traversal path pointing to a sensitive file. The web server deletes the target file with the privileges of the PHP process. See the Wordfence Vulnerability Report for additional technical context.

No verified public proof-of-concept code is available at the time of publication. The vulnerability mechanism involves an unsanitized file path parameter being passed directly to PHP's unlink() function via the plugin's cache cleanup handler.

Detection Methods for CVE-2025-12089

Indicators of Compromise

Unexpected deletion of wp-config.php, .htaccess, or core WordPress files on sites running the Supsystic plugin.
WordPress sites unexpectedly presenting the initial setup/installation screen to visitors.
Administrator-authenticated POST requests to admin-ajax.php referencing the Supsystic Data Tables plugin with path parameters containing ../ sequences.
Web server error logs showing failed file operations referencing paths outside the plugin's cache directory.

Detection Strategies

Inspect web access logs for requests to the plugin's AJAX actions that include traversal patterns or absolute paths in POST data.
Monitor filesystem integrity for unexpected deletions of PHP configuration files, especially wp-config.php.
Enumerate WordPress installations and identify sites running Data Tables Generator by Supsystic at version 1.10.45 or earlier.
Review administrator account activity logs for unusual plugin interactions following credential changes or new admin account creation.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root, with alerts on deletion of configuration files.
Centralize WordPress audit logs and administrator action logs to a SIEM for correlation with web traffic.
Alert on HTTP 500 responses or sudden traffic shifts to WordPress setup URLs such as /wp-admin/setup-config.php.

How to Mitigate CVE-2025-12089

Immediate Actions Required

Update the Data Tables Generator by Supsystic plugin to the version released after 1.10.45 that addresses this vulnerability.
Audit all WordPress Administrator accounts, remove unused accounts, and enforce multi-factor authentication for remaining administrators.
Review recent administrator activity for signs of exploitation, including file deletions and new account creation.
Back up wp-config.php and core files, and verify integrity against known-good copies.

Patch Information

The vendor has released a fix tracked in the WordPress Plugin Change Log. Site operators should upgrade through the WordPress plugin manager or deploy the patched release manually. Confirm the installed plugin version is greater than 1.10.45 after the update.

Workarounds

Deactivate and remove the Data Tables Generator by Supsystic plugin until the patched version is deployed.
Restrict filesystem permissions on wp-config.php to prevent deletion by the web server user where feasible.
Deploy a web application firewall rule to block requests to admin-ajax.php containing directory traversal sequences in plugin parameters.
Limit Administrator role assignment to a minimal set of trusted accounts and enforce IP allowlisting on /wp-admin/.

bash

# WAF rule example (ModSecurity) to block traversal in Supsystic plugin requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012089,msg:'CVE-2025-12089 traversal attempt'"
  SecRule ARGS "@contains ../" \
    "chain"
    SecRule ARGS:action "@rx supsystic|data_tables|cleanCache"