CVE-2025-32631: Arbitrary File Access in Oxygen MyData for WooCommerce

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and read files outside of the intended directory. Successful exploitation could expose sensitive data such as configuration files, database credentials, or even source code. While the plugin itself might not contain highly sensitive information, the server environment it runs within often does. An attacker could leverage this access to gain a deeper understanding of the server's infrastructure, potentially leading to further exploitation attempts. The impact is amplified if the server hosts other critical applications or data.

1. Reserved2025-04-09
2. Published2025-04-11
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32631 is to immediately upgrade Oxygen MyData for WooCommerce to version 1.0.64 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on the WordPress server to minimize the potential damage from a successful exploit. Regularly review WordPress plugin configurations and ensure they adhere to security best practices.

Active installs

300Known

Plugin rating