CVE-2025-1972 Overview
CVE-2025-1972 affects the Export and Import Users and Customers plugin for WordPress developed by Webtoffee. The vulnerability exists in the admin_log_page() function due to insufficient file path validation. Authenticated attackers with Administrator-level access or above can delete arbitrary log files on the server. All plugin versions up to and including 2.6.2 are affected. The flaw is categorized under CWE-73: External Control of File Name or Path.
Critical Impact
Authenticated attackers holding Administrator privileges can delete arbitrary log files on the underlying WordPress host, potentially disrupting site integrity and availability.
Affected Products
- Webtoffee Export and Import Users and Customers plugin for WordPress
- All versions up to and including 2.6.2
- WordPress and WooCommerce installations using the vulnerable plugin
Discovery Timeline
- 2025-03-22 - CVE-2025-1972 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1972
Vulnerability Analysis
The Export and Import Users and Customers plugin exposes an administrative log management page that allows administrators to remove historical log files. The admin_log_page() function accepts a file path parameter without adequate validation. As a result, the function processes attacker-controlled input as a target for deletion. The plugin logic does not restrict deletion to files inside a whitelisted log directory. This enables path traversal sequences to redirect the deletion operation to files outside the intended scope.
Root Cause
The root cause is CWE-73: External Control of File Name or Path. The admin_log_page() handler in admin/modules/history/history.php trusts request parameters as filesystem targets. It does not canonicalize the path or verify that the resolved location resides within the plugin's log directory. The absence of sanitization allows traversal sequences and absolute paths to reach the underlying file deletion call.
Attack Vector
Exploitation requires an authenticated account with Administrator or higher privileges. The attacker submits a crafted request to the plugin's history log management endpoint, supplying a file path parameter that references a target file. Because the plugin does not enforce a base directory, the resolved path can point to any file writable by the web server process. The vulnerability manifests over the network against exposed WordPress admin interfaces.
No public proof-of-concept is available. See the Wordfence Vulnerability Report and the vulnerable code in the WordPress Plugin History Log source for technical details.
Detection Methods for CVE-2025-1972
Indicators of Compromise
- Unexpected deletion of files under wp-content/, wp-includes/, or WordPress log directories on hosts running the Webtoffee plugin.
- Administrator-level HTTP POST requests to the plugin's history log endpoint containing path traversal sequences such as ../ in file parameters.
- Missing or truncated plugin history log files after routine administrative sessions.
Detection Strategies
- Review WordPress admin-ajax.php and admin page access logs for requests referencing the plugin's history module with suspicious file path parameters.
- Correlate administrator authentication events with subsequent filesystem deletion events on the WordPress host.
- Monitor plugin version inventories and flag installations of Webtoffee import_export_wordpress_users at version 2.6.2 or earlier.
Monitoring Recommendations
- Enable filesystem integrity monitoring on the WordPress installation directory to detect unauthorized file removals.
- Aggregate WordPress access logs into a centralized SIEM and alert on requests to the plugin's history endpoint with path parameters.
- Track administrator account activity and alert on off-hours actions involving log file management.
How to Mitigate CVE-2025-1972
Immediate Actions Required
- Upgrade the Export and Import Users and Customers plugin to a version newer than 2.6.2 that includes the fix from WordPress Change Set 3259688.
- Audit WordPress Administrator accounts and remove or rotate credentials for accounts that are unused or shared.
- Enforce multi-factor authentication for all WordPress Administrator sessions to limit abuse of the required privilege level.
Patch Information
Webtoffee addressed the vulnerability in WordPress Change Set 3259688. Site owners should update the plugin through the WordPress plugin manager. Additional developer information is available on the WordPress Plugin Developer page.
Workarounds
- Deactivate and remove the Export and Import Users and Customers plugin until the update can be applied.
- Restrict access to the WordPress admin interface using IP allowlists at the web server or WAF layer.
- Apply least-privilege principles by limiting the number of accounts with the Administrator role.
- Configure a Web Application Firewall to block requests containing path traversal patterns targeting the plugin's history endpoint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
