Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2018-25325: Woocommerce CSV Importer Deletes Sensitive Files
CVE-2018-25325
Summary
A security issue in Woocommerce CSV Importer allows any registered user to delete files on your website. This can happen if an attacker tricks a registered user into submitting a special filename. To protect your site, update Woocommerce CSV Importer to the latest version.
Original title
Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenames through the delete_export_file AJA...
Original description
Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenames through the delete_export_file AJAX action. Attackers can craft POST requests with directory traversal sequences in the filename parameter to delete sensitive files like wp-config.php outside the intended export directory.
nvd CVSS3.1
7.5
nvd CVSS4.0
8.7
Vulnerability type
CWE-22
Path Traversal
Published: 17 May 2026 · Updated: 31 May 2026 · First seen: 17 May 2026