CVE-2025-54029: 
WordPress vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2025-54029) was discovered in the WooCommerce csv import export WordPress plugin, affecting versions up to and including 2.0.6. The vulnerability was initially reported by researcher 0xd4rk5id3 on July 16, 2025, and was publicly disclosed on August 26, 2025 (Patchstack).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue, identified as CWE-22. It has received a CVSS v3.1 score of 7.7 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (NVD, Patchstack).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. This can potentially lead to remote code execution when critical files such as wp-config.php are deleted (Rapid7).

Users are advised to update to version 2.0.7 or later of the WooCommerce csv import export plugin to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).