CVE-2025-5391: Arbitrary File Access in Purchase Orders for WooCommerce

The core of the vulnerability lies in the delete_file() function, which lacks proper file path validation. An attacker can craft malicious requests to specify arbitrary file paths, bypassing security checks. Successful deletion of wp-config.php, which contains sensitive database credentials and other configuration details, would grant the attacker complete control over the WordPress installation. This could involve modifying website content, injecting malicious code, stealing user data, or even pivoting to other systems on the network. The ease of exploitation, requiring only Subscriber-level access, significantly broadens the attack surface.

1. Reserved2025-05-30
2. Published2025-08-12
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade to a patched version of the Purchase Orders for WooCommerce plugin. The vendor has not yet released a fixed version, so temporary workarounds are necessary. Consider restricting file upload permissions to prevent attackers from uploading malicious files that could be targeted for deletion. Implement a Web Application Firewall (WAF) with rules to block suspicious file deletion requests. Regularly monitor server logs for unusual file access or deletion activity. If upgrading is not immediately possible, consider temporarily disabling the plugin.

Active installs

40

Plugin rating