PT-2025-29710 · Unknown+1 · Woocommerce+1

Michael Mazzolini · Published 2025-07-16 · Updated 2025-07-21 · CVE-2025-7359

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Counter live visitors for WooCommerce plugin for WordPress versions up to and including 1.3.6

Description The Counter live visitors for WooCommerce plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the wcvisitor get block function. This allows unauthenticated attackers to delete all files within a targeted directory, potentially leading to data loss or a denial of service.

Recommendations Update Counter live visitors for WooCommerce plugin for WordPress to a version later than 1.3.6.

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-7359

Affected Products

Counter Live Visitors For Woocommerce

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-7359 · Security Note
• https://plugins.trac.wordpress.org/browser/counter-visitor-for-woocommerce/tags/1.3.6/woo-counter-visitor.php#L378 · Note
• https://twitter.com/CVEnew/status/1945389105011155215 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3333208 · Note
• https://twitter.com/cracbot/status/1947250249590018503 · Twitter Post
• https://t.me/cvetracker/27934 · Telegram Post