CVE-2025-9215

Vulnerability

Overview

The StoreEngine WordPress plugin (versions up to and including 1.5.0) contains a path traversal vulnerability in its CSV Import/Export feature. The file_download() function in the storeengine_csv/file_download endpoint lacks proper path sanitization, allowing an attacker to traverse directories and read arbitrary files. The endpoint only relies on a nonce (storeengine_nonce) for security, but this nonce is exposed to all frontend users through the plugin's JavaScript, making it accessible to any authenticated user [1][2].

Exploitation

To exploit this vulnerability, an attacker must be authenticated with at least Subscriber-level access. Additionally, the CSV Import/Export addon must be enabled by an administrator (requires manage_options capability). Once these conditions are met, the attacker can extract the nonce from frontend pages and send a crafted request to download any file on the server, such as wp-config.php, which contains database credentials and other sensitive information [1][2].

Impact

Successful exploitation allows an authenticated attacker to read arbitrary files on the server, including WordPress configuration files, plugin source code, and other sensitive system files. This can lead to full disclosure of credentials, API keys, and other secrets, potentially enabling further compromise of the WordPress site and its underlying infrastructure [1][2].

Mitigation

The vulnerability has been patched in version 1.5.1 of the StoreEngine plugin. Users are strongly advised to update to the latest version immediately. If updating is not possible, administrators should disable the CSV Import/Export addon to prevent exploitation [1][2].