CVE-2025-2007: WordPress CSV XML Plugin Path Traversal

CVE-2025-2007 Overview

CVE-2025-2007 is an arbitrary file deletion vulnerability in the Import Export Suite for CSV and XML Datafeed plugin for WordPress. The flaw exists in the deleteImage() function, which fails to validate file paths before performing deletion operations. All versions up to and including 7.19 are affected, and the issue was reintroduced in version 7.20 before being patched again in 7.20.1. Authenticated attackers with Subscriber-level access or higher can delete arbitrary files on the server. Deleting sensitive files such as wp-config.php can lead to remote code execution by forcing the site into a setup state controlled by the attacker. The vulnerability is tracked under [CWE-23] (Relative Path Traversal).

Critical Impact
Authenticated Subscriber-level users can delete arbitrary files on the WordPress server, enabling site takeover and remote code execution.

Affected Products

Import Export Suite for CSV and XML Datafeed plugin for WordPress, versions up to and including 7.19
Import Export Suite for CSV and XML Datafeed plugin for WordPress, version 7.20 (regression)
WordPress sites with the plugin active and Subscriber registration enabled

Discovery Timeline

2025-04-01 - CVE-2025-2007 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-2007

Vulnerability Analysis

The vulnerability resides in the deleteImage() function within MediaHandling.php of the wp-ultimate-csv-importer plugin. The function accepts a file path or filename parameter from an authenticated request and passes it to a file deletion routine without validating that the target resides within the plugin's expected media directory. Because authentication requirements only enforce Subscriber-level privileges, any registered user on a site that allows open registration can invoke the endpoint. Deleting wp-config.php triggers WordPress to enter its installation flow, which an attacker can complete with their own database credentials to gain administrative control and execute arbitrary code.

Root Cause

The root cause is insufficient input validation and path normalization in the deleteImage() handler. The function does not canonicalize the supplied path, reject path traversal sequences such as ../, or enforce a directory allow-list. Additionally, the capability check on the AJAX endpoint is too permissive, granting Subscriber accounts access to a destructive administrative function. The patch in version 7.20.1, visible in the WordPress Plugin Changeset, restricts the deletion target and tightens authorization.

Attack Vector

An authenticated attacker with at least Subscriber privileges sends a crafted request to the plugin's media handling endpoint, supplying a relative path that traverses outside the intended media directory. The vulnerable function resolves the path and unlinks the target file. The attacker can repeatedly invoke the endpoint to remove plugin files, theme files, or wp-config.php to coerce site reinstallation and obtain administrator privileges.

For technical specifics, see the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the original patch.

Detection Methods for CVE-2025-2007

Indicators of Compromise

Unexpected HTTP POST requests to admin-ajax.php invoking the plugin's media deletion action from low-privilege user sessions
Missing or recently deleted wp-config.php, plugin, or theme files on disk without corresponding administrative activity
WordPress site unexpectedly displaying the installation wizard (/wp-admin/install.php)
New administrator accounts created shortly after a wave of file deletion requests

Detection Strategies

Monitor web server access logs for requests to plugin AJAX endpoints containing path traversal sequences such as ../ in parameter values
Alert on filesystem deletion events for wp-config.php, .htaccess, and core WordPress files using file integrity monitoring
Correlate Subscriber-level authenticated sessions with administrative or destructive AJAX actions, which is anomalous behavior

Monitoring Recommendations

Enable WordPress audit logging for user role activity and file changes within the webroot
Forward web server, PHP error, and filesystem audit logs to a centralized SIEM for correlation
Track plugin version inventory across WordPress sites and alert when versions ≤7.19 or 7.20 are detected

How to Mitigate CVE-2025-2007

Immediate Actions Required

Update the Import Export Suite for CSV and XML Datafeed plugin to version 7.20.1 or later on every affected WordPress instance
Audit existing user accounts and remove unnecessary Subscriber-level accounts, especially on sites with open registration
Verify the integrity of wp-config.php and core WordPress files, and restore from backup if tampering is found
Rotate database credentials and WordPress secret keys if file deletion or reinstallation activity is suspected

Patch Information

The vendor patched the issue in version 7.20.1. The fix introduces stricter path validation and authorization checks in MediaHandling.php. Review the original patch changeset and the regression fix changeset for implementation details.

Workarounds

Disable the Import Export Suite for CSV and XML Datafeed plugin until it can be updated to version 7.20.1
Disable open user registration in WordPress general settings to reduce the population of Subscriber accounts
Apply a Web Application Firewall (WAF) rule that blocks requests to the plugin's media handling endpoint containing ../ or absolute paths
Restrict filesystem permissions so the web server user cannot delete wp-config.php or other critical files

bash

# Example: deny path traversal in plugin AJAX requests at the WAF or web server layer
# nginx rule snippet
location = /wp-admin/admin-ajax.php {
    if ($args ~* "action=.*deleteImage.*\.\./") {
        return 403;
    }
}