CVE-2025-7359: Arbitrary File Access in WooCommerce Counter

The vulnerability lies in the wcvisitorgetblock function, where insufficient file path validation allows an attacker to specify a directory and delete all files within it. This is a significant risk because it bypasses authentication, meaning any unauthenticated user can trigger the file deletion. The impact extends beyond simple data loss; a targeted attacker could delete critical WordPress files, effectively crippling the website and potentially requiring a complete rebuild. The ability to delete arbitrary files also opens the door to denial-of-service attacks, where an attacker could repeatedly delete files to disrupt website operations.

1. Reserved2025-07-08
2. Published2025-07-16
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the Counter live visitors for WooCommerce plugin to a version with the vulnerability patched. Until a patch is available, consider implementing temporary workarounds. One approach is to restrict file permissions on the WordPress installation to limit the attacker's ability to delete files, though this may impact legitimate plugin functionality. Web application firewalls (WAFs) can be configured to block requests containing suspicious file paths. Regularly monitor server logs for unusual file deletion activity. After upgrading, verify the fix by attempting to access the vulnerable endpoint with a crafted request and confirming that file deletion is prevented.

Active installs

6KNiche

Plugin rating