IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
2.7Baja

CVE-2025-1911Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function

webtoffee Product Import Export for WooCommerce – Import Export Product CSV Suite Publicada: (hace 1 año)

Descripción

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.

Debilidad (CWE): CWE-73

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
webtoffee product import export for woocommerce < 2.5.1
webtoffee Product Import Export for WooCommerce – Import Export Product CSV Suite ≤ 2.5.0

Referencias y parches

Coincidencias CPE (NVD) (1)
  • cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:* < 2.5.1

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación
CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…