What is the CVSS score of CVE-2026-25397?

CVE-2026-25397 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of File Uploader for WooCommerce are affected by CVE-2026-25397?

The File Uploader for WooCommerce plugin (versions ≤1.0.4) contains an unauthenticated path traversal vulnerability that could allow attackers to read sensitive files including database credentials…

How to fix or mitigate CVE-2026-25397?

Within 24 hours: Identify all WordPress installations using File Uploader for WooCommerce plugin and document current versions via administrative console or plugin audit. Within 7 days: Disable or remove the File Uploader for WooCommerce plugin from all instances running version 1.0.4 or earlier; implement a qualified alternative file upload solution. Within 30 days: Verify complete removal through security scanning, audit access logs for exploitation attempts during the vulnerability window, and evaluate a Web Application Firewall (WAF) rule to block malformed path sequences ('.../...//' patterns) on all WordPress upload endpoints as a preventive control.

File Uploader for WooCommerce CVE-2026-25397

EUVD-2026-15709 HIGH

Path Traversal: '.../...//' (CWE-35)

2026-03-25 Patchstack

WordPress Path Traversal File Uploader For Woocommerce Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 02:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 16:12 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15709

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Path Traversal: '.../...//' vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through <= 1.0.4.

AnalysisAI

Unauthenticated path traversal in File Uploader for WooCommerce plugin (versions ≤1.0.4) allows remote attackers to read arbitrary files from the WordPress server via malformed file path sequences ('.../...//'). The vulnerability permits high-impact confidentiality breach through network-accessible endpoints without authentication, potentially exposing wp-config.php, database credentials, and other sensitive server files. EPSS score of 0.03% suggests low observed exploitation probability despite the critical CVSS 7.5 rating, and SSVC assessment confirms no active exploitation at time of analysis. Reported by Patchstack, this WordPress plugin vulnerability affects installations where the file upload functionality processes user-controlled path inputs without proper sanitization.

Technical ContextAI

This vulnerability exploits a path traversal weakness (CWE-35) in the File Uploader for WooCommerce WordPress plugin's file handling mechanisms. The specific attack vector uses a variant path traversal sequence ('.../...//' instead of standard '../') to bypass inadequate input validation. Affected product identified by CPE cpe:2.3:a:snowray_software:file_uploader_for_woocommerce:*:*:*:*:*:*:*:* indicates all versions through 1.0.4 are vulnerable. The plugin likely processes file upload or retrieval requests without normalizing paths or validating against directory traversal patterns beyond standard dot-dot-slash sequences. This allows attackers to escape intended upload/download directories and access arbitrary files readable by the web server process, typically www-data or nginx user. WordPress plugins handling file operations are particularly susceptible when they construct file paths by concatenating user input without canonicalization or whitelist validation against allowed directories.

RemediationAI

Primary remediation is upgrading File Uploader for WooCommerce to version 1.0.5 or later if Snowray Software has released a patched version addressing CVE-2026-25397 (verify current version availability at https://patchstack.com/database/Wordpress/Plugin/file-uploader-for-woocommerce/vulnerability/wordpress-file-uploader-for-woocommerce-plugin-1-0-4-path-traversal-vulnerability). If no patched version exists, immediately disable or uninstall the plugin until vendor fix is available - consult WooCommerce documentation for alternative file upload solutions that maintain business functionality. Compensating controls for organizations unable to remove the plugin: restrict plugin access to authenticated administrator roles only via WordPress capability management (reduces attack surface from AV:N/PR:N to PR:H, though does not eliminate vulnerability), implement web application firewall rules blocking requests containing '.../' patterns in file path parameters (may cause false positives for legitimate filenames), and enable restrictive file permissions on sensitive WordPress configuration files (chmod 400 wp-config.php) to limit read access even if traversal succeeds. Review web server access logs for suspicious file access patterns targeting configuration files as potential indicators of exploitation attempts. Note that WAF-based mitigations may be bypassed through encoding variations and should not substitute for patching.