TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletion

The primary impact of CVE-2025-4564 is the ability for an unauthenticated attacker to delete files on the WordPress server. The most critical scenario involves deleting the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file would effectively disable the WordPress site and allow the attacker to potentially gain control of the database. Furthermore, deletion of other critical system files could lead to denial of service or further compromise. The ease of exploitation, combined with the potential for RCE, makes this a high-severity vulnerability.

WordPress sites utilizing the TicketBAI Facturas para WooCommerce plugin, particularly those running versions 0.0.0 through 3.18, are at risk. Shared hosting environments are especially vulnerable, as they often have limited file permission controls and increased exposure to malicious actors. Sites with legacy WordPress configurations or those lacking robust security monitoring are also at higher risk.

• wordpress / plugin: Use wp-cli plugin list to identify installations of TicketBAI Facturas para WooCommerce. Check plugin version using wp plugin version ticketbai-facturas-para-woocommerce. • wordpress / plugin: Examine plugin files for the 'delpdf' action and related file path validation logic. Use grep -r 'delpdf' /path/to/wordpress/wp-content/plugins/ticketbai-facturas-para-woocommerce/. • generic web: Monitor web server access logs for requests containing the 'delpdf' parameter with unusual or potentially malicious file paths. Look for patterns like /wp-content/plugins/ticketbai-facturas-para-woocommerce/delpdf?file=/etc/passwd.

1. 2025-05-15Disclosure

   disclosure

1. Reserviert2025-05-12
2. Veröffentlicht2025-05-15
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-4564 is to upgrade the TicketBAI Facturas para WooCommerce plugin to a patched version as soon as it becomes available. Until a patch is released, consider disabling the 'delpdf' action within the plugin if it is not essential. As a temporary workaround, restrict file permissions on the WordPress server to prevent unauthorized file deletion. Implement a Web Application Firewall (WAF) rule to block requests targeting the 'delpdf' action with suspicious parameters. Monitor WordPress logs for any unusual file deletion attempts.

Aktive Installationen

60

Plugin-Bewertung