CVE-2025-1769mediumCWE-22

CVE-2025-1769: falha de média gravidade em webtoffee Product Import Export for…

Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Product Import Export for WooCommerce – Import Export Product CSV Suite

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.9epss 0.8%
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
webtoffee · Product Import Export for WooCommerce – Import Export Product CSV Suite
CVEs relacionadas — webtoffee Product Import Export for…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-1913HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data ParameterEPSS 0.9%CVE-2025-1911LOWProduct Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2025-1912HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file FunctionEPSS 0.4%