CVE-2025-7359
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
2Description
The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition.
Analysis
Arbitrary file deletion in Counter live visitors for WooCommerce plugin (WordPress) versions ≤1.3.6 allows unauthenticated attackers to delete entire directories on the server through insufficient path validation in wcvisitor_get_block function. Exploitation wipes all files within targeted directories, causing data loss or denial of service. Attack requires no authentication (CVSS PR:N). No public exploit identified at time of analysis.
Technical Context
CWE-22 path traversal flaw in wcvisitor_get_block function fails to sanitize file paths, enabling directory traversal sequences. Unauthenticated context (PR:N) permits remote invocation. Unlike typical arbitrary file deletion, this vulnerability deletes entire directory contents recursively, amplifying integrity and availability impact beyond single-file targets.
Affected Products
Counter live visitors for WooCommerce plugin for WordPress, all versions through 1.3.6. Vendor: unknown/community plugin. CPE not provided in source data. Affects WordPress installations with plugin active.
Remediation
Upstream fix available via Trac changeset 3333208; released patched version not independently confirmed. Immediately deactivate Counter live visitors for WooCommerce plugin until vendor releases confirmed patched version beyond 1.3.6. Monitor WordPress plugin repository for updated release. For critical WooCommerce environments, replace with alternative visitor tracking solution. Implement web application firewall rules blocking suspicious path traversal patterns in wcvisitor_get_block requests. Review server logs for unauthorized file deletion attempts targeting plugin endpoints. Restore affected files from backups if exploitation suspected. Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=cve and https://plugins.trac.wordpress.org/changeset/3333208
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today