Directory Traversal Vulnerability in Product Import Export for WooCommerce by WordPress

CVE-2025-1769

What is CVE-2025-1769?

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is susceptible to a Directory Traversal vulnerability. This flaw affects all versions up to and including 2.5.0, allowing authenticated users with Administrator-level access and above to exploit the download_file() function. Attackers can access arbitrary log files on the server, potentially exposing sensitive information and internal data, thereby compromising the integrity and confidentiality of the web application.

References