CVE-2025-1973 Overview
CVE-2025-1973 is a path traversal vulnerability [CWE-22] in the Webtoffee Export and Import Users and Customers plugin for WordPress. The flaw affects all versions up to and including 2.6.2. It resides in the download_file() function, which fails to sanitize user-supplied file path parameters. Authenticated attackers with Administrator-level access or above can read the contents of arbitrary log files on the server. These files may contain sensitive information such as credentials, tokens, or personally identifiable data collected during import and export operations.
Critical Impact
Authenticated administrators can traverse the server file system through the plugin's download_file() function to disclose the contents of arbitrary log files.
Affected Products
- Webtoffee Export and Import Users and Customers plugin for WordPress
- All versions up to and including 2.6.2
- WordPress installations running the users-customers-import-export-for-wp-woocommerce plugin
Discovery Timeline
- 2025-03-22 - CVE-2025-1973 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1973
Vulnerability Analysis
The vulnerability exists in the plugin's download_file() function within the history module (admin/modules/history/history.php). The function accepts a file path parameter from an authenticated request and passes it to file-read operations without normalizing directory traversal sequences such as ../. An administrator can request paths outside the intended log directory and receive the contents of arbitrary files that the WordPress process can read.
While exploitation requires Administrator privileges, the vulnerability still expands the impact of any compromised administrator account. Stolen or hijacked admin credentials can be turned into a broader file-disclosure primitive, exposing configuration files, plugin logs, or artifacts left behind by other applications on the shared host.
Root Cause
The root cause is missing input validation and path canonicalization on the file identifier consumed by download_file(). The function does not enforce that the resolved path stays within the plugin's expected log directory. As classified under CWE-22, the code trusts attacker-controlled input to construct a file system path.
Attack Vector
The attack is executed over the network against the WordPress admin interface. An authenticated attacker holding an Administrator role sends a crafted request to the plugin's download endpoint with a traversal payload in the file parameter. The server responds with the contents of the referenced log file. No user interaction from another operator is required. Refer to the WordPress Plugin History Log source and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2025-1973
Indicators of Compromise
- HTTP requests to the plugin's download handler containing directory traversal sequences such as ../, ..%2f, or absolute paths in the file parameter.
- Unexpected file-read activity from the PHP worker process targeting paths outside the plugin's log directory.
- Web server access logs showing administrator-authenticated sessions repeatedly invoking the plugin's history or download endpoints.
Detection Strategies
- Inspect WordPress and reverse proxy logs for requests to admin/modules/history/ endpoints that include suspicious file parameter values.
- Alert on outbound downloads of files with sensitive extensions such as .log, .env, .ini, or wp-config.php initiated through plugin download URLs.
- Correlate administrator logins from anomalous IP addresses with subsequent access to the plugin's export or history features.
Monitoring Recommendations
- Enable WordPress audit logging for administrator activity and export or import events performed by the plugin.
- Monitor the installed plugin version against the fixed release using automated inventory tooling.
- Track EPSS trend data for CVE-2025-1973 to prioritize remediation as exploitation likelihood evolves.
How to Mitigate CVE-2025-1973
Immediate Actions Required
- Update the Export and Import Users and Customers plugin to a version newer than 2.6.2 that includes the fix committed in WordPress Changeset 3259688.
- Audit WordPress administrator accounts, remove unused privileged users, and rotate credentials for accounts that accessed the plugin recently.
- Enforce multi-factor authentication on all WordPress administrator accounts to reduce the risk of credential-based abuse.
Patch Information
The vendor addressed the issue in the plugin repository under WordPress Changeset 3259688. Administrators should upgrade through the WordPress plugin manager or download the latest release from the plugin developer page. Verify the running version after the update to confirm the patched build is active.
Workarounds
- Deactivate and remove the plugin until it can be upgraded to the fixed version.
- Restrict access to the WordPress admin area with an IP allow list at the web server or WAF layer.
- Deploy a web application firewall rule that blocks ../ and encoded traversal sequences in requests to the plugin's download endpoints.
- Restrict file system permissions for the PHP worker so it cannot read sensitive files outside the WordPress webroot.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.