CVE-2025-5391: WooCommerce Purchase Orders Path Traversal

CVE-2025-5391 Overview

CVE-2025-5391 affects the WooCommerce Purchase Orders plugin for WordPress. The plugin contains an arbitrary file deletion flaw in the delete_file() function caused by insufficient file path validation. All versions up to and including 1.0.2 are affected.

Authenticated attackers with Subscriber-level access or higher can delete arbitrary files on the underlying server. Deleting sensitive files such as wp-config.php forces WordPress into a setup state, which attackers can leverage to achieve remote code execution. The issue is tracked under CWE-22 (Path Traversal).

Critical Impact
Low-privileged authenticated users can delete wp-config.php and pivot to full site takeover and remote code execution.

Affected Products

WooCommerce Purchase Orders plugin for WordPress, versions through 1.0.2
WordPress sites running the wc-purchase-orders plugin with Subscriber registration enabled
E-commerce deployments that expose the vulnerable delete_file() endpoint to authenticated users

Discovery Timeline

2025-08-12 - CVE-2025-5391 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5391

Vulnerability Analysis

The vulnerability resides in the delete_file() function in class-bbpo-purchase-orders-files.php at line 148. The function accepts a file path parameter from an authenticated request and passes it to a file deletion routine without enforcing a canonical base directory or rejecting traversal sequences such as ../.

Because the capability check only requires Subscriber-level access, any authenticated user on the site can invoke the deletion handler. The plugin also exposes related logic in class-bbpo-purchase-orders.php at line 151, which contributes to the unsafe call chain. Successful exploitation lets attackers delete arbitrary files outside the intended uploads directory.

Deleting wp-config.php is the most direct path to remote code execution. WordPress treats the missing configuration as a fresh install and presents the setup wizard, allowing attackers to reconfigure the database connection to a server they control and load malicious PHP through the admin interface.

Root Cause

The root cause is missing path validation in delete_file(). The function does not normalize the input path, does not verify the resolved path remains inside the plugin's upload directory, and does not enforce an allowlist of deletable files. Combined with an overly permissive capability requirement, this produces a Path Traversal weakness ([CWE-22]).

Attack Vector

The attack vector is network-based and requires authentication at the Subscriber level, a role that many WooCommerce sites permit through open registration. The attacker submits a crafted request to the plugin's file deletion endpoint with a relative path that escapes the intended directory. No user interaction is required. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-5391

Indicators of Compromise

Missing or zero-byte wp-config.php, .htaccess, or core WordPress files on a site running the wc-purchase-orders plugin
WordPress setup wizard (/wp-admin/setup-config.php) served unexpectedly to visitors
Unexpected POST requests from Subscriber-level accounts to plugin AJAX or admin-post endpoints handling file deletion
New PHP files in wp-content/uploads/ or theme directories following file deletion activity

Detection Strategies

Monitor web server logs for authenticated POST requests targeting wc-purchase-orders handlers containing ../ sequences or absolute paths in parameters
Alert on file integrity changes to wp-config.php and other root-level WordPress files
Correlate Subscriber-role logins with subsequent administrative file operations or PHP file creation

Monitoring Recommendations

Enable WordPress audit logging for user role activity and plugin AJAX actions
Forward web server and PHP error logs to a centralized SIEM and create rules for path traversal patterns
Track installed plugin versions across hosted sites and flag any instance of wc-purchase-orders at version 1.0.2 or earlier

How to Mitigate CVE-2025-5391

Immediate Actions Required

Update the WooCommerce Purchase Orders plugin to a version later than 1.0.2 that incorporates WordPress Changeset #3356360
Disable the wc-purchase-orders plugin until patching is verified if an update is not yet available
Audit user accounts and remove untrusted Subscriber-level accounts created through open registration
Verify integrity of wp-config.php and core WordPress files, restoring from backup if tampering is detected

Patch Information

The maintainers addressed the issue in WordPress Changeset #3356360. The fix introduces path validation in delete_file() so the function only operates on files within the plugin's intended upload directory. Review the vulnerable code in the WordPress Plugin Source File and the WordPress Plugin Class File.

Workarounds

Disable open user registration in WordPress (Settings > General > Membership) to limit the population of authenticated attackers
Restrict access to plugin admin-ajax endpoints with a web application firewall rule blocking traversal patterns
Apply filesystem permissions that prevent the PHP process from deleting files outside of wp-content/uploads/

bash

# Restrict write/delete permissions on critical WordPress files
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
chattr +i /var/www/html/wp-config.php