CVE-2025-23562: XLSXviewer Path Traversal Vulnerability

CVE-2025-23562 Overview

CVE-2025-23562 is a path traversal vulnerability in the pitinca XLSXviewer (xlsx-viewer) WordPress plugin. The flaw affects all versions up to and including 2.1.1. An attacker can supply crafted pathname input to escape the intended directory and delete arbitrary files on the underlying web server. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Exploitation requires no authentication and no user interaction, and it can be triggered remotely over the network.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on the WordPress host, potentially disrupting site availability or enabling follow-on attacks such as configuration tampering.

Affected Products

pitinca XLSXviewer (xlsx-viewer) WordPress plugin
All versions from initial release through 2.1.1
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-01-22 - CVE-2025-23562 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23562

Vulnerability Analysis

The XLSXviewer plugin fails to properly validate or normalize file path parameters passed to a file-handling routine. An attacker crafts a request that includes directory traversal sequences such as ../ to reference locations outside the plugin's intended working directory. The plugin then acts on the attacker-controlled path, resulting in arbitrary file deletion on the server. According to the Patchstack advisory, the impact is arbitrary file deletion.

Root Cause

The root cause is missing input sanitization on a filename or path parameter processed by the plugin. The code does not canonicalize the path or restrict operations to a whitelisted directory. Because file deletion operates with the privileges of the PHP process, an attacker can remove any file the web server user can write to, including wp-config.php, plugin files, or uploaded assets.

Attack Vector

Exploitation occurs over the network with no privileges and no user interaction. The scope is changed, meaning impact extends beyond the vulnerable component. An attacker sends an HTTP request to the vulnerable plugin endpoint containing traversal sequences in the file parameter. The plugin resolves the crafted path and invokes a delete operation against the referenced file. Deletion of wp-config.php forces WordPress into a setup state, which an attacker can leverage to hijack the installation by pointing it at an attacker-controlled database.

No verified public proof-of-concept code is available. See the Patchstack WordPress Plugin Vulnerability advisory for technical details.

Detection Methods for CVE-2025-23562

Indicators of Compromise

HTTP requests to WordPress admin-ajax.php or plugin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in file or filename parameters.
Unexpected deletion of wp-config.php, plugin files, or theme files coinciding with plugin activity in access logs.
WordPress installation reverting to the initial setup wizard after an inbound request to the xlsx-viewer plugin.

Detection Strategies

Inspect web server access logs for requests targeting xlsx-viewer plugin routes that include traversal patterns or absolute paths.
Monitor file integrity on the WordPress root directory and wp-content for unexplained deletions.
Correlate WordPress admin activity with plugin AJAX handlers to identify anonymous callers reaching authenticated-only functionality.

Monitoring Recommendations

Enable a web application firewall ruleset that blocks path traversal payloads on POST parameters used by WordPress plugins.
Alert on any modification or deletion event affecting wp-config.php and core WordPress files.
Track plugin inventory across managed WordPress sites to flag installations of xlsx-viewer <= 2.1.1.

How to Mitigate CVE-2025-23562

Immediate Actions Required

Deactivate and remove the xlsx-viewer plugin from all WordPress installations until a patched release is confirmed.
Restrict access to WordPress AJAX and admin endpoints from untrusted networks where feasible.
Back up wp-config.php, the database, and wp-content before any recovery or removal action.

Patch Information

At the time of publication, no fixed version above 2.1.1 is referenced in the available advisory. Review the Patchstack advisory for updates on a fixed release from the plugin author.

Workarounds

Uninstall the xlsx-viewer plugin and replace its functionality with a maintained alternative.
Deploy WAF rules that reject requests containing directory traversal sequences targeting plugin endpoints.
Enforce least-privilege filesystem permissions so the web server user cannot delete WordPress core files.

bash

# Example WAF rule to block path traversal on xlsx-viewer endpoints
# ModSecurity example
SecRule REQUEST_URI "@contains xlsx-viewer" \
    "chain,id:1002301,phase:2,deny,status:403,msg:'Path traversal attempt on xlsx-viewer'"
    SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase"