CVE-2018-25325
Published: 17 May 2026
Summary
CVE-2018-25325 is a high-severity Path Traversal (CWE-22) vulnerability in Com (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 47.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
NVD Description
Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenames through the delete_export_file AJAX action. Attackers can craft POST requests with directory traversal sequences in the filename parameter…
more
to delete sensitive files like wp-config.php outside the intended export directory.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)