Arbitrary File Deletion Vulnerability in WordPress Import Export Suite for CSV and XML Datafeed

CVE-2025-2007

What is CVE-2025-2007?

The Import Export Suite for CSV and XML Datafeed plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation in its deleteImage() function. This vulnerability affects all versions up to and including 7.19, enabling authenticated attackers with Subscriber-level access or higher to delete arbitrary files from the server. Such actions can result in severe consequences, including the potential for remote code execution if critical files, such as wp-config.php, are targeted for deletion.

References