PT-2026-2809 · Unknown+1 · Woocommerce+1

Published 2026-01-14 · Updated 2026-01-22 · CVE-2025-14301

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Integration Opvius AI for WooCommerce plugin for WordPress versions up to and including 1.3.0

Description The Integration Opvius AI for WooCommerce plugin for WordPress is susceptible to a Path Traversal issue. This is caused by the process table bulk actions() function failing to properly validate user-supplied file paths, lacking authentication checks and nonce verification. An unauthenticated attacker can exploit this by manipulating the wsaw-log[] POST parameter to delete or download arbitrary files on the server, potentially including critical files like wp-config.php or sensitive configuration files.

Recommendations Update Integration Opvius AI for WooCommerce plugin for WordPress to a version later than 1.3.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14301

Affected Products

Integration Opvius Ai For Woocommerce

Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-14301 · Security Note
• https://twitter.com/TheHackerWire/status/2011333063448404459 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L79 · Note
• https://twitter.com/CVEnew/status/2011382999447642179 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L41 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/34612902-1a26-4759-bca6-b5aaffa25af4?source=cve · Note
• https://twitter.com/cracbot/status/2013204850499367281 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L160 · Note
• https://twitter.com/MNovofastovsky/status/2014233556382306554 · Twitter Post