CVE-2025-10897: Arbitrary File Access in WooCommerce Designer Pro

The primary impact of CVE-2025-10897 is the potential for unauthorized access to sensitive files on the server. An attacker could exploit this vulnerability to read files such as wp-config.php, which contains database credentials, allowing them to gain full control over the WordPress database. Successful exploitation could lead to data breaches, website defacement, and complete compromise of the WordPress installation. The lack of authentication required for exploitation significantly increases the attack surface and potential for widespread abuse.

1. Reserved2025-09-23
2. Published2025-10-31
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-10897 is to upgrade WooCommerce Designer Pro to version 1.9.31 or later. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict file permissions on sensitive files like wp-config.php to prevent unauthorized access. Implement a Web Application Firewall (WAF) with rules to block attempts to access arbitrary files. Monitor WordPress logs for suspicious file access attempts. After upgrading, confirm the vulnerability is resolved by attempting to access a non-existent file via the vulnerable endpoint and verifying that access is denied.