CVE-2025-14301: 
WordPress vulnerability analysis and mitigation

CVE-2025-14301 is a Path Traversal vulnerability (CWE-22) in the Integration Opvius AI for WooCommerce plugin for WordPress, affecting all versions up to and including 1.3.0. The flaw allows unauthenticated remote attackers to delete or download arbitrary files on the server, including critical files such as wp-config.php. It was disclosed on January 14, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is the process_table_bulk_actions() function in vendor/woosa/logger/class-module-logger-hook.php, which processes user-supplied file paths via the wsaw-log[] POST parameter without performing any authentication checks, nonce verification, or path validation (CWE-22). Because the function is accessible to unauthenticated users and accepts arbitrary file paths, an attacker can supply path traversal sequences (e.g., ../../) to reference files outside the intended log directory. This enables both arbitrary file deletion and arbitrary file read/download operations against the underlying server filesystem (Wordfence, WordPress Trac).

Successful exploitation gives an unauthenticated attacker full read and delete access to arbitrary files on the server. Deleting wp-config.php can trigger WordPress's installation wizard, potentially allowing a complete site takeover by reconfiguring the database connection. Reading wp-config.php or other sensitive configuration files exposes database credentials, secret keys, and salts, enabling further compromise including database access, credential theft, and lateral movement within the hosting environment (Wordfence, Red Hat CVE).

As of the time of disclosure, no public proof-of-concept exploit code has been identified and no active in-the-wild exploitation has been observed (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.087%, reflecting a currently low probability of near-term exploitation. However, the zero-authentication requirement and critical impact make it a high-priority target if exploitation tooling is developed.

1. Reconnaissance: Identify WordPress sites running the Integration Opvius AI for WooCommerce plugin (version ≤ 1.3.0) using passive techniques such as checking readme.txt or plugin-specific assets in the site's source code.
2. Identify the vulnerable endpoint: Locate the WordPress admin-post or AJAX action handler that invokes process_table_bulk_actions() — this function is accessible without authentication or nonce verification.
3. Craft a malicious POST request: Send an HTTP POST request to the target WordPress site's action endpoint with the wsaw-log[] parameter set to a path traversal payload, e.g., wsaw-log[]=../../wp-config.php.
4. Exfiltrate sensitive files: If the action triggers a file download, retrieve the contents of wp-config.php to obtain database credentials, secret keys, and salts.
5. Delete critical files (optional): Alternatively, submit the traversal payload targeting wp-config.php with a delete action to remove the file, triggering WordPress's reinstallation wizard and enabling site takeover.
6. Leverage obtained credentials: Use extracted database credentials to access the WordPress database directly, escalate privileges, or pivot to other systems in the hosting environment (Wordfence, WordPress Trac).

• Network: Unexpected HTTP POST requests to WordPress action endpoints (e.g., admin-post.php or admin-ajax.php) containing wsaw-log[] parameters with path traversal sequences such as ../ or URL-encoded equivalents (%2e%2e%2f).
• Logs: Web server access logs showing POST requests with wsaw-log parameters referencing files outside the plugin's log directory; repeated 200 responses to such requests from unauthenticated sources.
• File System: Absence or unexpected modification timestamp of wp-config.php; unexpected access timestamps on sensitive configuration files such as .env, wp-config.php, or database configuration files.
• Application: WordPress triggering its installation wizard (indicating wp-config.php deletion); unexpected database connection errors or site unavailability following suspicious POST activity.

No patched version of the Integration Opvius AI for WooCommerce plugin has been confirmed as available at the time of disclosure. Site administrators should immediately disable or uninstall the plugin on all WordPress installations running version 1.3.0 or earlier. As a compensating control, deploy Web Application Firewall (WAF) rules to block POST requests containing path traversal patterns (e.g., ../, %2e%2e) in the wsaw-log[] parameter. Additionally, implement file integrity monitoring on critical files such as wp-config.php and restrict web server read/write permissions to the minimum necessary (Wordfence).

Wordfence identified and reported the vulnerability, publishing it to their threat intelligence database on January 14, 2026, and including it in their weekly WordPress vulnerability report for January 12–18, 2026 (Wordfence Weekly Report). The vulnerability was also referenced in The Hacker News's weekly security recap, indicating moderate community awareness (The Hacker News). Qualys added detection for this CVE (detection ID 530829) in their January 2026 application security detections release.