CVE-2025-1769: Webtoffee WooCommerce Path Traversal Flaw

CVE-2025-1769 Overview

CVE-2025-1769 is a directory traversal vulnerability in the Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress. The flaw affects all versions up to and including 2.5.0 and resides in the download_file() function. Authenticated attackers with Administrator-level access or higher can read the contents of arbitrary log files on the server. These files frequently contain sensitive operational data, including configuration details, database errors, and user information. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated administrators can read arbitrary log files on the hosting server, potentially exposing credentials, database errors, and other sensitive data useful for further compromise.

Affected Products

Webtoffee Product Import Export for WooCommerce plugin, all versions up to and including 2.5.0
WordPress sites running the Import Export Product CSV Suite
WooCommerce installations with the vulnerable plugin enabled

Discovery Timeline

2025-03-26 - CVE-2025-1769 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1769

Vulnerability Analysis

The vulnerability resides in the download_file() function within the plugin's history module. The function accepts a user-supplied file path parameter and passes it to a file read operation without sufficient validation. Attackers can supply traversal sequences such as ../ to escape the intended log directory and reference arbitrary files elsewhere on the filesystem.

Because the exposure is limited to log files reachable by the web server process, the integrity and availability of the host remain unaffected. Confidentiality, however, is directly impacted. Log files commonly contain stack traces, database queries with embedded parameters, API tokens, and error messages that aid lateral movement.

Exploitation requires authenticated Administrator access, which raises the privilege bar. However, administrator accounts are frequently targeted through credential stuffing, phishing, and session hijacking. Once an attacker obtains such an account, this flaw accelerates reconnaissance across the hosting environment.

Root Cause

The download_file() function in admin/modules/history/history.php does not canonicalize or restrict the requested path to an allowlisted directory. The missing path sanitization allows directory traversal input to resolve outside the plugin's intended log folder. See the vulnerable function in the plugin source.

Attack Vector

An authenticated attacker issues a crafted HTTP request to the plugin's history download endpoint. The request supplies a filename parameter containing traversal sequences pointing to a target log file outside the plugin directory. The web server returns the file contents in the response. Full technical details are available in the Wordfence vulnerability report.

// Conceptual request pattern (sanitized)
// The download_file() handler fails to validate the user-supplied path
// before reading and returning file contents.
GET /wp-admin/admin.php?page=<plugin>&action=download_file&file=../../../../wp-content/debug.log

Detection Methods for CVE-2025-1769

Indicators of Compromise

HTTP requests to the plugin's history or download handlers containing ../, ..%2f, or encoded traversal sequences in the file or path parameter
Unexpected administrator-session downloads of .log, .conf, or wp-config adjacent files from the web server
Access log entries showing authenticated requests referencing paths outside /wp-content/uploads/ initiated from the plugin interface

Detection Strategies

Inspect WordPress access logs for requests to the Product Import Export plugin endpoints that include directory traversal patterns in query strings
Correlate administrator logins with subsequent file download requests to the plugin and alert when non-standard file paths are referenced
Deploy web application firewall rules that normalize path parameters and block traversal sequences targeting WordPress admin endpoints

Monitoring Recommendations

Enable WordPress audit logging to capture administrator actions, including plugin-initiated file access
Forward web server access and PHP error logs to a centralized SIEM for query-based detection of traversal attempts
Monitor the integrity of administrator accounts, flagging logins from new IP addresses or user agents to reduce the attack surface for this authenticated flaw

How to Mitigate CVE-2025-1769

Immediate Actions Required

Update the Product Import Export for WooCommerce plugin to a version later than 2.5.0 that contains the fix from WordPress Changeset #3261194
Audit WordPress administrator accounts, remove unused privileged users, and enforce multi-factor authentication to limit abuse of the required access level
Review web server and WordPress logs for prior access to the vulnerable download_file() endpoint with traversal payloads

Patch Information

The vendor addressed the issue in the plugin repository through WordPress Changeset #3261194. The fix restricts the download_file() function to the intended log directory and rejects path traversal input. Site operators should install the latest release available on the plugin page.

Workarounds

If immediate patching is not possible, deactivate the Product Import Export for WooCommerce plugin until the update is applied
Restrict access to /wp-admin/ through IP allowlisting or VPN enforcement to reduce exposure of the authenticated endpoint
Apply a WAF rule that blocks requests to the plugin's download handler containing .., %2e%2e, or absolute path references

bash

# Example ModSecurity rule to block traversal in plugin download requests
SecRule REQUEST_URI "@contains product-import-export-for-woo" \
  "chain,id:1000769,phase:2,deny,status:403,msg:'Block traversal in WooCommerce plugin download'"
  SecRule ARGS "@rx \.\./|%2e%2e%2f|%2e%2e/" "t:lowercase,t:urlDecodeUni"