CVE-2025-54029: WooCommerce CSV Import Export Vulnerability

CVE-2025-54029 Overview

CVE-2025-54029 is a path traversal vulnerability in the extendons WooCommerce CSV Import Export plugin for WordPress. The flaw affects all versions of extendons-eo-wooimport-export up to and including 2.0.6. An authenticated attacker with low privileges can manipulate file path parameters to access or delete files outside the intended directory. According to the Patchstack advisory, this issue enables arbitrary file deletion on the underlying server. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress host, including wp-config.php, which can lead to site takeover and full availability loss.

Affected Products

extendons WooCommerce CSV Import Export plugin (extendons-eo-wooimport-export)
All versions from initial release through 2.0.6
WordPress installations using the affected plugin with WooCommerce

Discovery Timeline

2025-08-28 - CVE-2025-54029 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54029

Vulnerability Analysis

The vulnerability resides in the CSV import and export handlers of the extendons-eo-wooimport-export plugin. The plugin accepts user-supplied file path or filename parameters without enforcing a canonical path within the intended upload directory. An authenticated user with access to the import/export functionality can supply traversal sequences such as ../ to reference files outside the plugin's working directory.

The attack requires network access and authenticated low-privilege access to the WordPress admin interface. No user interaction is required to trigger the flaw. The scope is changed because file operations affect resources beyond the vulnerable component, impacting the entire WordPress instance and its filesystem.

The primary impact identified by Patchstack is arbitrary file deletion. Deletion of critical WordPress files such as wp-config.php triggers WordPress to enter the setup state, which an attacker can abuse to reconnect the site to an attacker-controlled database and achieve administrative takeover.

Root Cause

The plugin fails to validate and sanitize file path inputs before passing them to filesystem operations. Functions handling CSV import or export accept filenames or paths directly from request parameters, then concatenate them with a base directory without resolving the canonical path or rejecting traversal sequences like .. and absolute paths.

Attack Vector

An attacker authenticates to the WordPress site with an account that has access to plugin functionality. The attacker submits a crafted request to the plugin's import or export endpoint containing a file path parameter referencing a target outside the upload directory. The plugin resolves the traversal and performs the file operation against the targeted location.

The vulnerability is described in the Patchstack Vulnerability Report. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2025-54029

Indicators of Compromise

HTTP requests to plugin endpoints containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in file parameters.
Unexpected deletion or absence of WordPress core files such as wp-config.php, .htaccess, or theme files.
WordPress installation reverting to the initial setup screen without administrative action.
Web access logs showing authenticated users invoking import/export actions with abnormal file path values.

Detection Strategies

Inspect web server logs for POST requests to extendons-eo-wooimport-export admin handlers containing traversal patterns or absolute paths.
Enable WordPress audit logging plugins to record plugin actions taken by authenticated users.
Run file integrity monitoring against the WordPress root and wp-content directories to alert on deletions.

Monitoring Recommendations

Alert on any deletion of wp-config.php, .htaccess, or files in wp-admin/ and wp-includes/.
Monitor for sudden HTTP 500 errors or installation-wizard responses from production WordPress sites.
Track authenticated user activity from accounts with shop manager or administrator roles for anomalous import/export usage.

How to Mitigate CVE-2025-54029

Immediate Actions Required

Disable or uninstall the extendons-eo-wooimport-export plugin until a fixed version is confirmed installed.
Audit WordPress user accounts and revoke import/export permissions for non-essential roles.
Restore any deleted files from backup and verify integrity of wp-config.php and core WordPress files.
Rotate WordPress administrator credentials and database secrets if compromise is suspected.

Patch Information

At the time of NVD publication, the advisory lists affected versions through 2.0.6 with no fixed version identified in the CVE record. Review the Patchstack Vulnerability Report for current patch status and upgrade to the latest vendor release once available.

Workarounds

Restrict access to WordPress admin endpoints using web application firewall rules blocking traversal patterns in plugin parameters.
Apply filesystem permissions that prevent the PHP process from deleting WordPress core files where operationally feasible.
Limit plugin administrative access to a small number of trusted accounts protected by multi-factor authentication.

bash

# Example WAF rule (ModSecurity) to block path traversal in plugin parameters
SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1054029,phase:2,deny,status:403,\
     msg:'CVE-2025-54029 path traversal attempt against extendons plugin',\
     tag:'CWE-22'"