EUVD-2025-208918
GHSA-f926-gc7c-947h
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H
Lifecycle Timeline
3Tags
Description
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.
Analysis
The Invelity Product Feeds plugin for WordPress contains an arbitrary file deletion vulnerability through path traversal in versions up to and including 1.2.6. Authenticated administrators can be socially engineered into clicking malicious links that delete arbitrary server files due to missing validation in the createManageFeedPage function. No evidence of active exploitation (not in KEV) exists, though the vulnerability is publicly documented with technical details available via WordPress plugin repository references.
Technical Context
This vulnerability affects the Invelity Product Feeds WordPress plugin (cpe:2.3:a:invelity:invelity_product_feeds) and stems from CWE-352 (Cross-Site Request Forgery) combined with path traversal weaknesses. The classPluginSettingsManageFeedPage.php file at line 60 in the createManageFeedPage function fails to properly validate and sanitize file path inputs, allowing directory traversal sequences (such as ../) to escape intended directories. While classified as CSRF, the core issue is insufficient input validation enabling path traversal attacks when processing file deletion requests. The WordPress plugin architecture allows plugins to handle file operations, and without proper sanitization, attackers can manipulate file paths to target system-critical files.
Affected Products
The Invelity Product Feeds plugin for WordPress is affected in all versions up to and including 1.2.6, as confirmed by CPE identifier cpe:2.3:a:invelity:invelity_product_feeds:*:*:*:*:*:*:*:*. The vulnerable code exists in the classPluginSettingsManageFeedPage.php file within the plugin's classes/admin directory, specifically affecting the createManageFeedPage function as documented in the WordPress plugin repository at http://plugins.trac.wordpress.org/browser/invelity-products-feeds/trunk/classes/admin/classPluginSettingsManageFeedPage.php. Additional vulnerability intelligence is available from Wordfence Threat Intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa?source=cve.
Remediation
Website administrators should immediately upgrade the Invelity Product Feeds plugin to version 1.2.7 or later if available, or remove the plugin entirely if patches are not yet released by the vendor. Administrators should review Wordfence Threat Intelligence guidance at https://www.wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa for the latest patch status and security recommendations. As an interim mitigation, implement Web Application Firewall (WAF) rules to detect and block requests containing directory traversal sequences (../, ../../, etc.) targeting the plugin's admin pages, restrict WordPress admin panel access to trusted IP addresses only, and educate administrators about the risks of clicking untrusted links while authenticated to WordPress. Monitor server logs for suspicious file deletion attempts and implement file integrity monitoring for critical system files.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today