CVE-2025-9215: 
WordPress vulnerability analysis and mitigation

CVE-2025-9215 is a Path Traversal vulnerability in the StoreEngine – Powerful WordPress eCommerce Plugin (all versions up to and including 1.5.0) that allows authenticated attackers with Subscriber-level access or higher to read arbitrary files from the server. The flaw resides in the file_download() function within the plugin's CSV Import/Export addon. It was published on September 17, 2025, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from the file_download() function in addons/csv/ajax/export.php failing to sanitize user-supplied file path input before using it in file system operations (Wordfence, Plugin Trac). The endpoint storeengine_csv/file_download relies solely on nonce verification for access control, but the storeengine_nonce is exposed to all frontend authenticated users via the plugin's localized JavaScript (StoreEngineGlobal), effectively bypassing CSRF protection. An attacker can extract this nonce from any frontend page and submit a crafted request with a path traversal payload (e.g., filename=../../../../wp-config.php) to read arbitrary server files. Exploitation requires the CSV Import/Export addon to be enabled by an administrator, but once active, any authenticated user — including subscribers — can exploit it (GitHub PoC).

Successful exploitation allows authenticated attackers to read the contents of arbitrary files on the server, with high confidentiality impact and no integrity or availability impact. Sensitive files at risk include wp-config.php (containing database credentials, authentication keys, and salts), API keys, private keys, plugin source code, and potentially system files such as /etc/passwd. While the vulnerability does not directly enable code execution, exposed credentials could facilitate lateral movement, privilege escalation, or full site compromise (Wordfence, GitHub PoC).

A public proof-of-concept exploit (CVE-2025-9215.py) is available on GitHub, demonstrating automated extraction of the nonce and download of wp-config.php via path traversal (GitHub PoC). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a low but non-negligible probability of exploitation in the near term (Feedly). No specific threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the StoreEngine plugin (versions ≤ 1.5.0) with the CSV Import/Export addon enabled, using tools like WPScan or Shodan.
2. Authenticate: Log in to the target WordPress site with any valid account at Subscriber level or above.
3. Extract nonce: Load any frontend page of the WordPress site and inspect the page source or JavaScript globals (e.g., StoreEngineGlobal.storeengine_nonce) to retrieve the exposed storeengine_nonce value.
4. Craft malicious request: Send a POST request to /wp-admin/admin-ajax.php with the action storeengine_csv/file_download, including the extracted nonce and a path traversal payload in the filename parameter (e.g., filename=../../../../wp-config.php).
5. Retrieve sensitive file: The server returns the contents of the requested file without path restriction, exposing database credentials, API keys, and security salts from wp-config.php or other targeted files.
6. Leverage credentials: Use extracted database credentials or API keys for further attacks such as database access, privilege escalation, or lateral movement (GitHub PoC).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=storeengine_csv/file_download and filename parameters containing ../ sequences or references to sensitive files (e.g., wp-config.php, /etc/passwd).
• Logs: WordPress access logs showing repeated requests to admin-ajax.php with path traversal patterns in query or POST parameters from low-privilege user accounts; HTTP 200 responses to such requests indicating successful file reads.
• File System: No direct file system artifacts are created by this read-only vulnerability, but review of recently accessed files (via audit tools) may reveal unauthorized reads of wp-config.php or system files.
• Application Logs: Unexpected file download activity in StoreEngine plugin logs or WordPress debug logs tied to the file_download() function from non-administrative users (GitHub PoC).

Upgrade the StoreEngine plugin to a version newer than 1.5.0; the patch was committed to the WordPress plugin repository (changeset 3360097) and addresses the missing path sanitization in export.php (Plugin Changeset). If an immediate upgrade is not possible, disable the CSV Import/Export addon within the StoreEngine plugin settings to eliminate the vulnerable endpoint. Additionally, review server logs for suspicious file_download() calls, audit which files may have been accessed, and rotate any credentials or keys stored in potentially exposed configuration files such as wp-config.php (Wordfence).

Wordfence reported the vulnerability as part of its weekly WordPress vulnerability report for September 15–21, 2025, highlighting it among notable plugin flaws (Wordfence Blog). Researcher Ryan Kozak (d0n601), who discovered and reported the vulnerability, published a detailed write-up and PoC on GitHub and their personal blog (Researcher Blog). The vulnerability was also noted on Bluesky by security community accounts, and Qualys included it in their November 2025 application security detections update.