CVE-2025-24611: WP Ultimate Exporter Path Traversal Flaw

CVE-2025-24611 Overview

CVE-2025-24611 is an absolute path traversal vulnerability in the Smackcoders WP Ultimate Exporter plugin for WordPress. The flaw affects all plugin versions up to and including 2.9. An authenticated attacker with high privileges can read arbitrary files on the server by supplying absolute paths to the plugin's export functionality. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers with administrative access can read sensitive files across the server file system, including WordPress configuration files containing database credentials and secret keys.

Affected Products

Smackcoders WP Ultimate Exporter (plugin slug: wp-ultimate-exporter)
All versions from n/a through <= 2.9
WordPress sites running the Export All Posts, Products, Orders, Refunds & Users plugin

Discovery Timeline

2025-01-24 - CVE-2025-24611 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24611

Vulnerability Analysis

The WP Ultimate Exporter plugin exports WordPress content such as posts, products, orders, refunds, and users to downloadable files. The vulnerable code paths accept user-controlled input describing the file or destination to process. The plugin fails to validate or normalize this input against a permitted base directory.

Because the input is passed directly to file system operations, an attacker can supply an absolute path such as /etc/passwd or /var/www/html/wp-config.php. The plugin returns or exposes the contents of the referenced file. The exposure is limited to confidentiality; the vulnerability does not allow file modification or code execution directly.

Root Cause

The root cause is missing path canonicalization and containment. The plugin does not enforce a whitelist of allowed directories or reject absolute paths. It also does not resolve .. sequences before opening files. As a result, any path the web server user can read becomes accessible through the plugin.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated account with high privilege. The attacker submits a crafted request to the plugin's export endpoint, supplying an absolute file path. The server responds with the file contents or writes them into a downloadable export artifact. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-24611

Indicators of Compromise

HTTP requests to WP Ultimate Exporter admin-ajax or plugin endpoints containing absolute paths such as /etc/, /var/, or C:\
Unexpected export files in the WordPress uploads directory containing contents of system files like wp-config.php, /etc/passwd, or SSH keys
WordPress access logs showing administrator sessions triggering unusual export requests
Outbound transfers of large export artifacts shortly after administrator authentication events

Detection Strategies

Inspect web server and WordPress logs for parameters passed to wp-ultimate-exporter endpoints that contain ../ sequences or absolute path prefixes
Alert on any read attempt against sensitive files (wp-config.php, .env, id_rsa) originating from the web server process
Correlate administrator logins with subsequent plugin export activity to identify anomalous administrator behavior or compromised admin accounts

Monitoring Recommendations

Enable WordPress audit logging for all plugin export operations and administrator actions
Monitor file access telemetry on the web host for reads outside the WordPress document root by the PHP worker process
Track outbound HTTP responses larger than expected export sizes to detect exfiltration of sensitive files

How to Mitigate CVE-2025-24611

Immediate Actions Required

Update WP Ultimate Exporter to a version later than 2.9 as soon as the vendor publishes a fixed release
Audit WordPress administrator accounts, remove unused privileged users, and enforce multi-factor authentication
Rotate secrets stored in wp-config.php, including database credentials and authentication keys, if compromise is suspected
Review recent export activity and uploads directory contents for files containing sensitive system data

Patch Information

No fixed version is listed in the NVD record at the time of publication. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for a patched release addressing the path traversal.

Workarounds

Deactivate and remove the WP Ultimate Exporter plugin until a patched version is available
Restrict access to the WordPress admin interface using IP allowlists or a VPN to reduce exposure
Deploy a web application firewall rule that blocks requests to plugin endpoints containing absolute path patterns or .. sequences
Run PHP with restrictive open_basedir settings that limit file access to the WordPress installation directory

bash

# Example php.ini restriction limiting file access to the WordPress root
open_basedir = "/var/www/html/wordpress/:/tmp/"