CVE-2025-9215: StoreEngine WordPress Path Traversal Flaw

CVE-2025-9215 Overview

CVE-2025-9215 is a path traversal vulnerability affecting the StoreEngine WordPress eCommerce plugin in all versions up to and including 1.5.0. The flaw resides in the file_download() function within the CSV export addon. Authenticated attackers with Subscriber-level access or higher can read arbitrary files on the underlying server. Exposed files may include wp-config.php, which stores WordPress database credentials and authentication keys. The vulnerability is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Low-privileged authenticated users can read sensitive files on the server, including WordPress configuration files containing database credentials and secret keys.

Affected Products

StoreEngine – WordPress eCommerce Plugin, versions ≤ 1.5.0
WordPress sites running the StoreEngine CSV export addon
Any WordPress installation permitting Subscriber-level registration with StoreEngine enabled

Discovery Timeline

2025-09-17 - CVE-2025-9215 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9215

Vulnerability Analysis

The vulnerability exists in the file_download() function located in addons/csv/ajax/export.php of the StoreEngine plugin. The function accepts a user-controlled file path parameter via an AJAX endpoint and passes it to file read operations without proper validation or canonicalization. Because the endpoint is reachable by any authenticated session, attackers only need a Subscriber account to interact with it.

Successful exploitation yields the contents of arbitrary readable files on the web server. Attackers commonly target wp-config.php to obtain database credentials, AUTH_KEY, SECURE_AUTH_KEY, and other secrets that enable lateral movement or full site takeover. Server configuration files, SSH keys, and application logs are also within reach when permissions allow.

Root Cause

The root cause is improper input validation of a filename or path parameter inside file_download(). The function fails to restrict reads to an allowed directory and does not reject traversal sequences such as ../. Any string accepted by the parameter is resolved against the filesystem, breaking out of the intended plugin export directory.

Attack Vector

Exploitation requires network access and a valid authenticated session with at least Subscriber privileges, a role that WordPress sites with open registration grant automatically. The attacker issues an AJAX request to the vulnerable export endpoint with a traversal payload referencing a target file. The server responds with the file contents, enabling disclosure of sensitive data without any user interaction.

For technical details and proof-of-concept, see the GitHub PoC Repository, the Ryan Kozak CVE Analysis, and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-9215

Indicators of Compromise

AJAX POST requests to the StoreEngine CSV export endpoint containing ../ or URL-encoded %2e%2e%2f traversal sequences
Requests to admin-ajax.php with StoreEngine export actions originating from Subscriber accounts that have no legitimate commerce workflow
Unexpected HTTP 200 responses from the export endpoint returning content that is not CSV formatted
Access attempts referencing sensitive paths such as wp-config.php, /etc/passwd, or .env

Detection Strategies

Inspect web server and WordPress logs for export AJAX calls containing path traversal patterns and alert on matches
Monitor the volume and frequency of file download requests tied to the StoreEngine CSV addon per authenticated user
Use a web application firewall (WAF) with signatures for [CWE-22] traversal payloads targeting admin-ajax.php

Monitoring Recommendations

Enable WordPress audit logging to track Subscriber account creation and AJAX activity from newly registered users
Alert on file reads of wp-config.php, SSH key paths, and .env files by the web server process outside expected routines
Review outbound responses from admin-ajax.php for abnormal content types and sizes associated with the StoreEngine export action

How to Mitigate CVE-2025-9215

Immediate Actions Required

Update the StoreEngine plugin to a version later than 1.5.0 that includes the patched file_download() function
Rotate WordPress salts, database credentials, and any API keys that may have been exposed through wp-config.php
Audit Subscriber-level accounts and remove any unknown or suspicious registrations created during the exposure window
Review web server logs for prior exploitation attempts referencing the StoreEngine export endpoint

Patch Information

The vendor addressed the issue in a StoreEngine release after 1.5.0. The code fix is documented in the WordPress Plugin Changeset, and the vulnerable code can be reviewed in the WordPress Plugin Code Review. Site operators should upgrade through the WordPress plugin manager and verify the installed version is beyond 1.5.0.

Workarounds

Disable the StoreEngine CSV export addon until the plugin is updated
Deactivate the StoreEngine plugin entirely if CSV export functionality is required and no patch is yet applied
Disable open user registration or restrict new accounts to a role that cannot access the vulnerable AJAX endpoint
Deploy WAF rules that block path traversal sequences in requests to admin-ajax.php with StoreEngine export actions

bash

# Example WAF rule concept blocking traversal in StoreEngine export requests
# ModSecurity-style pseudo rule
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1009215,msg:'CVE-2025-9215 StoreEngine path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"