CVE-2025-47535: Opal Woo Path Traversal Vulnerability

CVE-2025-47535 Overview

CVE-2025-47535 is a path traversal vulnerability [CWE-22] affecting the wpopal Opal Woo Custom Product Variation WordPress plugin. The flaw exists in all versions up to and including 1.2.0. Unauthenticated attackers can exploit the issue over the network without user interaction. Successful exploitation enables arbitrary file deletion on the host filesystem, leading to availability impact across affected WordPress installations. The vulnerability carries a scope change because deletion of critical files such as wp-config.php can compromise the broader site environment and allow follow-on attacks.

Critical Impact
Unauthenticated remote attackers can traverse directories and delete arbitrary files on WordPress sites running the Opal Woo Custom Product Variation plugin, enabling site takeover paths.

Affected Products

wpopal Opal Woo Custom Product Variation plugin for WordPress
All versions from n/a through 1.2.0
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-05-23 - CVE-2025-47535 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47535

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory within the Opal Woo Custom Product Variation plugin. Patchstack classifies the issue as an arbitrary file deletion flaw. The plugin accepts file path input from HTTP requests and passes it to a file deletion routine without normalizing or validating the path against an allowlisted directory.

An attacker supplies traversal sequences such as ../ to escape the intended upload or temporary directory. The deletion call then operates on files outside the plugin's working scope. Because the endpoint is reachable without authentication, any internet-facing WordPress instance running the vulnerable plugin is exposed.

Deleting wp-config.php triggers the WordPress installation wizard on the next request. An attacker can then point the site to an attacker-controlled database and gain administrative control, escalating impact from file deletion to full site compromise.

Root Cause

The root cause is missing input sanitization on a file path parameter handled by the plugin. The code does not call realpath() or a comparable canonicalization check before invoking the unlink operation. The handler also lacks capability checks and nonce validation, allowing unauthenticated requests to trigger destructive filesystem operations.

Attack Vector

Exploitation occurs over the network via crafted HTTP requests to the vulnerable plugin endpoint. No privileges or user interaction are required. The attacker supplies a relative path containing directory traversal characters that resolve to sensitive files outside the plugin's intended directory. Refer to the Patchstack Vulnerability Report for vendor-confirmed details.

Detection Methods for CVE-2025-47535

Indicators of Compromise

HTTP requests to plugin endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f
Unexpected deletion or absence of wp-config.php, .htaccess, or core WordPress files
WordPress installation wizard appearing on a previously configured site
Web server error logs reporting missing files referenced by wp-includes or wp-admin

Detection Strategies

Inspect web server access logs for POST or GET requests to Opal Woo Custom Product Variation endpoints containing path traversal patterns
Deploy file integrity monitoring on the WordPress document root to alert on deletion of core files
Use a web application firewall ruleset that blocks traversal sequences in plugin parameters

Monitoring Recommendations

Enable WordPress audit logging to capture plugin activity and unauthenticated administrative requests
Forward web server and PHP error logs to a centralized log platform for correlation
Alert on sudden spikes in 404 errors for WordPress core files, which can indicate post-deletion access attempts

How to Mitigate CVE-2025-47535

Immediate Actions Required

Disable or uninstall the Opal Woo Custom Product Variation plugin until a patched version is available
Restrict access to the WordPress wp-admin and plugin AJAX endpoints behind authentication or IP allowlists where feasible
Verify integrity of wp-config.php and other core files against known-good backups
Rotate database credentials and WordPress administrator passwords if compromise is suspected

Patch Information

At the time of NVD publication, no fixed version beyond 1.2.0 is documented. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for updates from the vendor wpopal.

Workarounds

Remove the plugin directory from wp-content/plugins/opal-woo-custom-product-variation if the plugin is not business-critical
Configure web application firewall rules to block requests containing ../, ..\, or encoded traversal variants targeting plugin endpoints
Apply filesystem permissions that prevent the PHP user from deleting files outside the upload directory

bash

# Example WAF rule pattern to block path traversal against the vulnerable plugin
SecRule REQUEST_URI "@contains opal-woo-custom-product-variation" \
    "chain,deny,status:403,id:1004753,msg:'Block CVE-2025-47535 traversal'"
SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"