CVE-2025-14037: WordPress Product Feeds Path Traversal

CVE-2025-14037 Overview

CVE-2025-14037 affects the Invelity Product Feeds plugin for WordPress in all versions up to and including 1.2.6. The vulnerability allows arbitrary file deletion through path traversal in the createManageFeedPage function. The plugin fails to validate and sanitize user-supplied input before processing file operations. Authenticated administrator-level attackers can delete arbitrary files on the server by submitting specially crafted requests containing path traversal sequences. Exploitation requires a successful social engineering step, where an attacker tricks an administrator into clicking a malicious link. The flaw is tracked under [CWE-352] (Cross-Site Request Forgery) due to the user interaction requirement combined with missing request validation.

Critical Impact
Successful exploitation enables deletion of arbitrary files on the WordPress server, including wp-config.php, which can lead to full site compromise and remote code execution.

Affected Products

Invelity Product Feeds plugin for WordPress — all versions through 1.2.6
WordPress installations using the vulnerable plugin
Any administrator session with the plugin enabled

Discovery Timeline

2026-03-21 - CVE-2025-14037 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2025-14037

Vulnerability Analysis

The vulnerability resides in the createManageFeedPage function within classPluginSettingsManageFeedPage.php. The function processes file-related parameters from HTTP requests without validating directory boundaries or sanitizing path components. Attackers can supply traversal sequences such as ../ to escape the intended working directory and reference arbitrary files on disk.

Because the deletion routine executes under the WordPress process account, it can remove any file the web server user can access. Removing wp-config.php forces WordPress into a setup state, which an attacker can leverage to point the installation at a database under their control and achieve remote code execution.

The issue is compounded by the lack of CSRF token validation, classified under [CWE-352]. An attacker who lures an authenticated administrator to a crafted page can trigger the file deletion request from the victim's browser without direct credential access.

Root Cause

Two defects combine to produce the vulnerability. First, the plugin omits a nonce check on the request handler, allowing forged requests from external origins. Second, the file path parameter is concatenated into a filesystem operation without canonicalization or allowlist validation, permitting path traversal.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or image tag targeting the vulnerable admin endpoint. When a logged-in WordPress administrator visits the attacker-controlled page, the browser issues an authenticated request to the WordPress site with traversal sequences in the file parameter. The plugin then deletes the targeted file. See the WordPress Plugin Code Review for the affected source location.

Detection Methods for CVE-2025-14037

Indicators of Compromise

Unexpected deletion of WordPress core files, particularly wp-config.php, .htaccess, or theme and plugin PHP files
HTTP POST or GET requests to the Invelity Product Feeds admin page containing ../ or URL-encoded %2e%2e%2f sequences
WordPress site reverting to the installation wizard without administrator action
Referer headers from external domains preceding admin file operations

Detection Strategies

Inspect web server access logs for requests to admin.php?page= endpoints belonging to the Invelity Product Feeds plugin combined with path traversal patterns in query parameters
Monitor filesystem audit logs for delete operations against WordPress files by the web server user
Alert on missing or modified wp-config.php files using file integrity monitoring

Monitoring Recommendations

Enable WordPress audit logging plugins to capture administrator-initiated actions and request origins
Deploy a web application firewall rule to block path traversal sequences in plugin admin requests
Track HTTP Referer anomalies on admin endpoints to identify cross-site request patterns

How to Mitigate CVE-2025-14037

Immediate Actions Required

Deactivate and remove the Invelity Product Feeds plugin until a patched version is released by the vendor
Restrict WordPress administrator browsing habits and require dedicated admin browsers or sessions
Apply file integrity monitoring to WordPress core files and back up wp-config.php to an off-server location
Review the Wordfence Vulnerability Report for vendor signature updates

Patch Information

At the time of NVD publication, no fixed version is referenced for the Invelity Product Feeds plugin. All versions up to and including 1.2.6 remain vulnerable. Administrators should monitor the WordPress plugin repository for an update that introduces nonce validation in createManageFeedPage and canonicalizes file path inputs before performing delete operations.

Workarounds

Remove the plugin from production sites until a vendor patch is published
Deploy a WAF rule that blocks requests containing ../, ..%2f, or %2e%2e sequences targeting WordPress admin URLs
Enforce SameSite=Strict cookies on the WordPress admin session to reduce CSRF exposure
Limit administrator accounts and use separate browsers or browser profiles for administrative work

bash

# Example ModSecurity rule to block path traversal in plugin admin requests
SecRule REQUEST_URI "@contains invelity-products-feeds" \
  "chain,id:1014037,phase:2,deny,status:403,log,msg:'CVE-2025-14037 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|\.\.\\)" "t:none,t:urlDecodeUni"