Arbitrary File Deletion Vulnerability in WooCommerce Purchase Orders Plugin by WordPress

CVE-2025-5391

What is CVE-2025-5391?

The WooCommerce Purchase Orders plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access and above to delete arbitrary files from the server. This vulnerability arises from inadequate validation of file paths within the delete_file() function. As a result, attackers can exploit this flaw to remove critical files from the server, such as the wp-config.php file, potentially leading to remote code execution and compromising the entire site.

References