Introduction
Deleting a single configuration file can hand an attacker control of an entire WordPress site. The WooCommerce Purchase Orders plugin, widely used for business-to-business workflows in the WordPress ecosystem, has a high-severity arbitrary file deletion flaw tracked as CVE-2025-5391. Any authenticated user with subscriber-level access or higher can use it to delete files anywhere on the server, including critical files like wp-config.php, which can lead to full site compromise.
About the software: WooCommerce is one of the most widely adopted e-commerce platforms for WordPress and runs millions of online stores around the world. The WooCommerce Purchase Orders plugin is a third-party extension that adds purchase order workflows for businesses. Because plugins like this one connect to payment and order processing systems, a vulnerability in one can cause significant damage beyond the plugin itself.
Technical Information
The vulnerability is in the delete_file() function in class-bbpo-purchase-orders-files.php of the WooCommerce Purchase Orders plugin. The function is meant to delete files related to purchase orders, but it does not adequately validate the file paths that users supply. Because it does not properly sanitize input, path traversal sequences (such as ../) can escape the intended directory and target arbitrary files on the server filesystem.
Key technical points:
- The flaw affects all versions of the plugin up to and including 1.0.2.
- Any authenticated user with subscriber-level access or higher can exploit it.
- An attacker can put directory traversal patterns in the file path parameter of a request and delete files outside the plugin's directory.
- Deleting
wp-config.phpor a similar critical file can trigger the WordPress installation routines, which an attacker can hijack to gain administrative access. - The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Vulnerable code location:
Detection Methods
Detecting unauthorized file deletion vulnerabilities like the one in the WooCommerce Purchase Orders plugin means watching for specific indicators and putting preventive measures in place.
Log analysis:
- Review server and application logs regularly for unexpected file deletion events, especially ones initiated by users with subscriber-level access.
- Watch for unusual access patterns, such as multiple deletion requests from one user or IP address, which may indicate exploitation attempts.
User activity monitoring:
- Audit user permissions periodically to make sure subscribers cannot delete critical files.
- Use monitoring tools that detect anomalous behavior, such as a subscriber attempting administrative actions.
File integrity checks:
- Deploy file integrity monitoring to detect unauthorized changes to critical files or their deletion.
- Set up automated alerts that notify administrators of any unauthorized file deletion attempt.
Security plugins and tools:
- Use a web application firewall (WAF) to block malicious requests that try to exploit file deletion vulnerabilities.
- Install reputable security plugins that offer real-time monitoring and protection against unauthorized actions.
Regular updates and patching:
- Keep all plugins, themes, and WordPress core updated to their latest versions to mitigate known vulnerabilities.
- Run vulnerability scans regularly so potential security issues are found and fixed promptly.
Source: Wordfence Threat Intelligence
Affected Systems and Versions
- WooCommerce Purchase Orders plugin for WordPress
- All versions up to and including 1.0.2
- Any WordPress installation with this plugin enabled is vulnerable if users with subscriber-level access or higher are present
Vendor Security History
WooCommerce core and its extension plugins have had several critical vulnerabilities. Notable incidents include:
- July 2021: A critical vulnerability in WooCommerce core prompted automatic security updates across more than 90 releases (source).
- 2018: A file deletion flaw in WooCommerce core allowed privilege escalation through log deletion (source).
These incidents point to recurring problems with secure file handling and access control in the WooCommerce and WordPress plugin ecosystem.
