Platform
wordpress
Component
extendons-eo-wooimport-export
Fixed in
2.0.7
CVE-2025-54029 is an Arbitrary File Access vulnerability affecting the WooCommerce CSV Import Export plugin. This vulnerability allows attackers to potentially read sensitive files on the server. It impacts versions 0.0.0 through 2.0.6 of the plugin, and a fix is available in version 2.0.7.
The Arbitrary File Access vulnerability in WooCommerce CSV Import Export allows an attacker to bypass intended security restrictions and access files outside of the intended directory. This could lead to the exposure of sensitive data such as configuration files, database credentials, or even source code. A successful exploit could compromise the entire WordPress installation and potentially lead to further attacks, including remote code execution if sensitive files contain executable code or credentials for other systems. The impact is amplified if the server hosts multiple WordPress sites or if the exposed files contain credentials for other services.
This vulnerability was publicly disclosed on 2025-08-28. As of this date, there are no known public exploits or active campaigns targeting this vulnerability. It is not currently listed on the CISA KEV catalog. The vulnerability's ease of exploitation and potential impact warrant close monitoring.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-54029 is to immediately upgrade the WooCommerce CSV Import Export plugin to version 2.0.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Carefully review file upload and import functionalities for any potential vulnerabilities. Monitor WordPress logs for suspicious file access attempts.
Update the WooCommerce csv import export plugin to a patched version. Check the developer's website or the WordPress repository for the latest available version. Ensure you perform a full site backup before updating any plugin.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-54029 is a vulnerability in WooCommerce CSV Import Export allowing attackers to read files outside the intended directory. It affects versions 0.0.0–2.0.6 and has a CVSS score of 7.7 (HIGH).
You are affected if you are using WooCommerce CSV Import Export version 0.0.0 through 2.0.6. Check your plugin version and upgrade immediately if necessary.
Upgrade the WooCommerce CSV Import Export plugin to version 2.0.7 or later. If immediate upgrade is not possible, implement WAF rules to block path traversal attempts.
As of 2025-08-28, there are no confirmed reports of active exploitation, but the vulnerability's potential impact warrants monitoring.
Refer to the extendons website and WordPress plugin repository for the latest updates and security advisories related to WooCommerce CSV Import Export.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.