What is the CVSS score of CVE-2025-7359?

CVE-2025-7359 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.9%.

Which versions of WordPress are affected by CVE-2025-7359?

Counter Live Visitors for WooCommerce plugin (versions ≤1.3.6) contains an arbitrary file deletion vulnerability allowing unauthenticated attackers to delete entire server directories, potentially…

How to fix or mitigate CVE-2025-7359?

Within 24 hours: Immediately disable and deactivate the Counter Live Visitors for WooCommerce plugin on all WordPress installations. Within 7 days: Audit backup integrity and test disaster recovery procedures; verify no unauthorized directory deletions occurred in access logs. Within 30 days: Evaluate alternative visitor tracking solutions that have undergone security review, and establish a plugin vulnerability monitoring process to catch similar issues before deployment.

WordPress CVE-2025-7359

HIGH

Path Traversal (CWE-22)

2025-07-16 security@wordfence.com

Path Traversal WordPress Denial Of Service

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Jul 16, 2025 - 07:15 nvd

HIGH 8.2

DescriptionCVE.org

The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition.

AnalysisAI

Arbitrary file deletion in Counter live visitors for WooCommerce plugin (WordPress) versions ≤1.3.6 allows unauthenticated attackers to delete entire directories on the server through insufficient path validation in wcvisitor_get_block function. Exploitation wipes all files within targeted directories, causing data loss or denial of service. Attack requires no authentication (CVSS PR:N). No public exploit identified at time of analysis.

Technical ContextAI

CWE-22 path traversal flaw in wcvisitor_get_block function fails to sanitize file paths, enabling directory traversal sequences. Unauthenticated context (PR:N) permits remote invocation. Unlike typical arbitrary file deletion, this vulnerability deletes entire directory contents recursively, amplifying integrity and availability impact beyond single-file targets.

Affected ProductsAI

Counter live visitors for WooCommerce plugin for WordPress, all versions through 1.3.6. Vendor: unknown/community plugin. CPE not provided in source data. Affects WordPress installations with plugin active.

RemediationAI

Upstream fix available via Trac changeset 3333208; released patched version not independently confirmed. Immediately deactivate Counter live visitors for WooCommerce plugin until vendor releases confirmed patched version beyond 1.3.6. Monitor WordPress plugin repository for updated release. For critical WooCommerce environments, replace with alternative visitor tracking solution. Implement web application firewall rules blocking suspicious path traversal patterns in wcvisitor_get_block requests. Review server logs for unauthorized file deletion attempts targeting plugin endpoints. Restore affected files from backups if exploitation suspected. Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=cve and https://plugins.trac.wordpress.org/changeset/3333208