CVE-2018-25325
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
May 17, 2026
Vendor
unknown
Description
Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenames through the delete_export_file AJAX action. Attackers can craft POST requests with directory traversal sequences in the filename parameter to delete sensitive files like wp-config.php outside the intended export directory.