Arbitrary File Deletion Vulnerability in Product Import Export for WooCommerce Plugin by WordPress
CVE-2025-1911
2.7LOW
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 March 2025
What is CVE-2025-1911?
The Product Import Export for WooCommerce plugin is susceptible to arbitrary file deletion due to insufficient validation of file paths in the admin_log_page() function. This vulnerability affects all versions up to and including 2.5.0, allowing authenticated attackers with Administrator-level access to delete any log files on the server, posing a significant security risk.
Affected Version(s)
Product Import Export for WooCommerce – Import Export Product CSV Suite * <= 2.5.0