CVE-2025-7359 - Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block

Back Back to CVE browser

HIGH

Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block

Published Jul 16, 2025

8.2

HIGH

CVSS 3.1

EPSS 0.52%

Description

The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition.

Affected products

Vendor Danielriera Product Counter live visitors for WooCommerce Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.3.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Danielriera

Counter live visitors for WooCommerce

unaffected

Version	Status	Constraints
0	affected	<=1.3.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21584		Advisory
https://plugins.trac.wordpress.org/browser/counter-visitor-for-woocommerce/tags/1.3.6/woo-counter-visitor.php#L378
https://plugins.trac.wordpress.org/changeset/3333208
https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=cve