CVE-2026-25328: 
WordPress vulnerability analysis and mitigation

CVE-2026-25328 is a Path Traversal (Arbitrary File Deletion) vulnerability in the "Product File Upload for WooCommerce" WordPress plugin developed by add-ons.org. It affects all versions up to and including 2.2.4, and was discovered by security researcher Denver Jackson and reported on January 6, 2026, with public disclosure on March 23–25, 2026. The vulnerability carries a CVSS v3.1 base score of 6.8 (High), exploitable by unauthenticated remote attackers under high attack complexity conditions (Patchstack, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The plugin fails to properly sanitize or restrict file paths provided during the product file upload process, allowing an attacker to supply a crafted path (e.g., using ../ sequences or URL-encoded variants) that traverses outside the intended upload directory and targets arbitrary files on the server for deletion. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting specific conditions or timing may be required (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the web server, with the scope of impact extending beyond the plugin itself (CVSS Scope: Changed). Deletion of WordPress core files, configuration files (e.g., wp-config.php), or other critical assets can cause the website to become completely non-functional, resulting in a high availability impact. While the CVSS score reflects no direct confidentiality or integrity impact, deletion of wp-config.php can trigger WordPress reinstallation flows that may expose database credentials or allow site takeover (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.026% (0.000260), indicating a currently low probability of exploitation in the wild. Patchstack has classified this as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity. There is no current CISA KEV catalog listing for this CVE (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the "Product File Upload for WooCommerce" plugin (version ≤ 2.2.4) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/products-file-upload-for-woocommerce/readme.txt.
2. Identify the vulnerable file upload endpoint: Locate the plugin's file upload or file management functionality, typically exposed via WooCommerce product pages or AJAX handlers registered by the plugin.
3. Craft a path traversal payload: Construct a malicious file path using directory traversal sequences (e.g., ../../wp-config.php, ../../../etc/passwd) or URL-encoded equivalents (e.g., %2e%2e%2f) targeting a critical server file.
4. Submit the malicious request: Send an unauthenticated HTTP request (POST or GET, depending on the plugin's endpoint) with the crafted path as the file reference parameter to trigger the deletion operation.
5. Achieve objective: The server processes the traversal path without proper validation and deletes the targeted file, potentially causing site outage (if core files are removed) or enabling further compromise (e.g., deleting wp-config.php to trigger reinstallation) (Patchstack).

• Network: Unauthenticated HTTP requests to WooCommerce/plugin endpoints containing path traversal sequences such as ../, %2e%2e%2f, or %2e%2e/ in file path parameters.
• Logs: WordPress or web server access logs showing requests to plugin AJAX handlers (e.g., wp-admin/admin-ajax.php with action parameters related to the plugin) with anomalous file path values; HTTP 200 responses to such requests from unauthenticated sessions.
• File System: Unexpected deletion of files outside the plugin's upload directory, particularly wp-config.php, WordPress core files, or other sensitive files; missing files in /wp-content/uploads/ or the WordPress root directory.
• Process: PHP error logs referencing unlink() or file deletion functions with paths outside expected upload directories (Patchstack).

The vendor has released version 2.2.5 of the "Product File Upload for WooCommerce" plugin, which patches this vulnerability. All users running version 2.2.4 or earlier should update immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin update is applied. If immediate updating is not possible, consider temporarily deactivating the plugin or restricting access to its file upload functionality (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering March 23–29, 2026, highlighting it as part of broader WordPress ecosystem security monitoring (Wordfence). Patchstack, the assigning CNA, flagged it as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).