High severity8.1NVD Advisory· Published Aug 12, 2025· Updated Apr 15, 2026
CVE-2025-5391
CVE-2025-5391
Description
The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected products
1- Range: <=1.0.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- plugins.trac.wordpress.org/browser/wc-purchase-orders/trunk/includes/class-bbpo-purchase-orders-files.phpnvd
- plugins.trac.wordpress.org/browser/wc-purchase-orders/trunk/includes/class-bbpo-purchase-orders.phpnvd
- plugins.trac.wordpress.org/changeset/3356360/nvd
- www.wordfence.com/threat-intel/vulnerabilities/id/05a27a34-b324-4968-937e-2c0d24175d2anvd
News mentions
0No linked articles in our index yet.