PT-2026-2809 · Woosaai · Integration Opvius Ai For Woocommerce

Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-14301

Mitre

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the

process table bulk actions()

function processing user-supplied file paths without authentication checks, nonce verification, or path validation. This makes it possible for unauthenticated attackers to delete or download arbitrary files on the server via the

wsaw-log[]

POST parameter, which can be leveraged to delete critical files like

wp-config.php

or read sensitive configuration files.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-14301

Affected Products

Integration Opvius Ai For Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14301 · Security Note
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L79 · Note
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L160 · Note
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/woosa-ai-for-woocommerce/tags/1.3.0/vendor/woosa/logger/class-module-logger-hook.php#L25 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/34612902-1a26-4759-bca6-b5aaffa25af4?source=cve · Note