CVE-2025-14037: WordPress Product Feeds Path Traversal

CVE-2025-14037 Overview

CVE-2025-14037 is a path traversal vulnerability affecting the Invelity Product Feeds plugin for WordPress. The vulnerability allows authenticated attackers with administrator-level privileges to delete arbitrary files on the server through specially crafted requests containing path traversal sequences. Exploitation requires social engineering—specifically tricking an administrator into clicking a malicious link, indicating a Cross-Site Request Forgery (CSRF) component to the attack chain.

Critical Impact

Successful exploitation enables attackers to delete critical system files, potentially leading to complete website compromise, denial of service, or privilege escalation by removing security configurations.

Affected Products

• Invelity Product Feeds plugin for WordPress versions up to and including 1.2.6

Discovery Timeline

• 2026-03-21 - CVE-2025-14037 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2025-14037

Vulnerability Analysis

This vulnerability exists due to insufficient input validation and sanitization within the createManageFeedPage function of the Invelity Product Feeds WordPress plugin. The function processes user-supplied file paths without properly validating or sanitizing path traversal sequences such as ../ or ..\\. While the vulnerability requires administrator-level authentication, the attack surface is expanded through a CSRF weakness—attackers can craft malicious links that, when clicked by an authenticated administrator, trigger the arbitrary file deletion.

The impact extends beyond simple data loss. By strategically deleting files such as wp-config.php, .htaccess, or security plugin configurations, an attacker could render the site inoperable, bypass security controls, or create conditions favorable for further exploitation.

Root Cause

The root cause is missing validation and sanitization of user-supplied input in the createManageFeedPage function located in classPluginSettingsManageFeedPage.php. The function accepts file path parameters without checking for path traversal sequences, allowing attackers to navigate outside the intended directory structure and target arbitrary files on the server filesystem.

Attack Vector

The attack is network-based and requires authenticated administrator access combined with user interaction (clicking a malicious link). An attacker must craft a specially formatted URL containing path traversal sequences and convince an authenticated WordPress administrator to click it. The vulnerable function processes the request and deletes the specified file without proper authorization checks or CSRF token validation.

The attack flow involves constructing a malicious request targeting the vulnerable createManageFeedPage function with path traversal sequences embedded in the file path parameter. For example, a path like ../../../../wp-config.php would traverse from the plugin directory up to the WordPress root and target the main configuration file for deletion. Technical details and the vulnerable code can be reviewed in the WordPress Plugin Code Review.

Detection Methods for CVE-2025-14037

Indicators of Compromise

• Unexpected deletion of WordPress core files, configuration files, or plugin/theme files
• Web server error logs showing requests to the Invelity Product Feeds plugin admin pages with unusual path parameters containing ../ sequences
• Missing wp-config.php, .htaccess, or other critical files without explanation
• Administrator access logs showing requests to plugin settings pages from unfamiliar referrers or IP addresses

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns in requests targeting WordPress plugin endpoints
• Implement file integrity monitoring (FIM) to detect unauthorized file deletions in WordPress directories
• Review HTTP access logs for requests containing encoded or unencoded path traversal sequences (../, %2e%2e%2f, ..%5c)
• Configure alerting for any file deletion operations originating from the Invelity Product Feeds plugin directory

Monitoring Recommendations

• Enable comprehensive logging for WordPress admin actions and plugin activity
• Deploy endpoint detection and response (EDR) solutions to monitor filesystem changes on web servers
• Implement real-time alerting for deletion of critical WordPress files such as wp-config.php and .htaccess
• Use SentinelOne Singularity Platform to detect and respond to suspicious file operations on WordPress hosting infrastructure

How to Mitigate CVE-2025-14037

Immediate Actions Required

• Update the Invelity Product Feeds plugin to a patched version if available
• Temporarily disable the Invelity Product Feeds plugin if no patch is available
• Implement Web Application Firewall (WAF) rules to block path traversal sequences in requests to WordPress admin endpoints
• Review recent administrator activity logs for suspicious link clicks or unusual plugin interactions
• Verify integrity of critical WordPress files using checksums or file integrity monitoring tools

Patch Information

Security updates should be obtained through the official WordPress plugin repository. Monitor the Wordfence Vulnerability Advisory for patch availability and additional remediation guidance.

Workarounds

• Restrict access to WordPress admin panel by IP address using .htaccess or server-level firewall rules
• Implement additional CSRF protection using security plugins such as Wordfence or Sucuri
• Remove or disable the Invelity Product Feeds plugin until a security patch is released
• Deploy a WAF rule to specifically block requests containing path traversal patterns targeting the plugin's admin pages

# .htaccess example to restrict admin access by IP
<Files "wp-admin/*">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.100
    Allow from 10.0.0.0/8
</Files>