CVE-2025-47649: WooCommerce Store Path Traversal Flaw

CVE-2025-47649 Overview

CVE-2025-47649 is a path traversal vulnerability in the StackWC Open Close WooCommerce Store plugin (woc-open-close) for WordPress. The flaw allows authenticated attackers to traverse directories using .../...// style sequences and trigger PHP Local File Inclusion (LFI). All plugin versions up to and including 4.9.9 are affected. The vulnerability is tracked under CWE-35: Path Traversal and impacts confidentiality, integrity, and availability of the WordPress host.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure and potential remote code execution on affected WordPress sites.

Affected Products

StackWC Open Close WooCommerce Store plugin (woc-open-close) versions up through 4.9.9
WordPress installations running the vulnerable plugin
WooCommerce stores relying on woc-open-close for scheduling functionality

Discovery Timeline

2025-05-07 - CVE-2025-47649 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-47649

Vulnerability Analysis

The vulnerability resides in how the Open Close WooCommerce Store plugin handles user-supplied path input. The plugin fails to normalize traversal sequences before passing values into PHP file inclusion functions such as include or require. Attackers using crafted sequences like .../...// can bypass naive filters that only strip a single ../ occurrence. This results in PHP Local File Inclusion, where attacker-controlled paths resolve to sensitive files outside the intended plugin directory.

Exploitation requires low-privileged authenticated access to the WordPress site. Successful inclusion of attacker-staged or system files can disclose credentials, leak configuration data such as wp-config.php, or execute PHP code if a writable log or upload path is included. The EPSS probability is 0.422%.

Root Cause

The root cause is improper sanitization of file path parameters before they reach a PHP file inclusion sink. The plugin's filter logic does not recursively collapse traversal sequences, allowing payloads such as .../...// to survive normalization and resolve to parent directories. This pattern matches CWE-35, which covers relative path traversal involving multiple dot variants.

Attack Vector

The attack vector is network-based. An authenticated attacker submits a request to a plugin endpoint that accepts a path or template parameter. By embedding .../...// sequences, the attacker forces PHP to include arbitrary local files. Refer to the Patchstack Vulnerability Report for additional technical context. No public proof-of-concept exploit code is verified at this time.

Detection Methods for CVE-2025-47649

Indicators of Compromise

Web server access logs containing requests to woc-open-close endpoints with ...//, ....//, or encoded traversal sequences such as %2e%2e%2f
Unexpected PHP errors referencing include() or require() with paths outside the plugin directory
Access requests targeting sensitive paths such as wp-config.php, /etc/passwd, or session files via plugin parameters
New or modified PHP files in wp-content/uploads/ following suspicious plugin requests

Detection Strategies

Inspect HTTP request parameters submitted to woc-open-close for traversal patterns including ../, .../...//, and URL-encoded variants
Correlate authenticated WordPress user sessions with anomalous file inclusion errors in PHP logs
Apply WAF rules that detect multi-dot traversal payloads, not just single ../ sequences

Monitoring Recommendations

Enable PHP error_log and forward WordPress logs to a centralized log platform for analysis
Alert on file integrity changes within wp-content/plugins/woc-open-close/ and wp-content/uploads/
Monitor outbound network connections from the WordPress host that could indicate post-exploitation activity

How to Mitigate CVE-2025-47649

Immediate Actions Required

Identify all WordPress installations running the woc-open-close plugin at version 4.9.9 or below
Upgrade to a patched release once available from StackWC, or deactivate and remove the plugin until a fix is released
Rotate WordPress administrative credentials and any secrets stored in wp-config.php if exploitation is suspected
Review user accounts with subscriber-level access or higher to remove unexpected contributors

Patch Information

At the time of NVD publication, the vendor-provided fixed version is not enumerated in the advisory. Consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for the latest released version and apply updates immediately. If a patched version is unavailable, removal of the plugin is the safest remediation.

Workarounds

Deactivate the woc-open-close plugin until a vendor patch is released and validated
Deploy a web application firewall rule that blocks requests containing traversal sequences such as .../...//, ....//, and encoded equivalents targeting the plugin
Restrict PHP open_basedir and allow_url_include directives to limit the scope of any file inclusion
Apply least-privilege filesystem permissions so the PHP process cannot read sensitive system files

bash

# Example WAF rule (ModSecurity) blocking multi-dot traversal toward the plugin
SecRule REQUEST_URI "@contains woc-open-close" \
  "chain,id:1004769,phase:2,deny,log,msg:'CVE-2025-47649 path traversal attempt'"
  SecRule ARGS "@rx (\.{2,}[\\/]){1,}" "t:none,t:urlDecodeUni"