CVE-2025-4564 in TicketBAI Facturas para WooCommerce Plugin
Summary
by MITRE • 05/15/2025
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/15/2025
The TicketBAI Facturas para WooCommerce plugin presents a critical security vulnerability classified as CVE-2025-4564 that stems from inadequate input validation mechanisms within its file handling functionality. This vulnerability exists within the plugin's 'delpdf' action implementation and affects all versions through 3.18, creating a significant attack surface for unauthenticated threat actors. The flaw resides in the plugin's failure to properly sanitize and validate file paths submitted through the web interface, allowing malicious users to manipulate the deletion process and target any file accessible to the web server process. The vulnerability directly maps to CWE-22 known as "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" which is a fundamental weakness in file system access control mechanisms. This weakness enables attackers to traverse directory structures and access files outside of intended directories, fundamentally undermining the security model of the application.
The operational impact of this vulnerability extends far beyond simple file deletion capabilities, as it creates a pathway for remote code execution when attackers strategically target critical system files. An unauthenticated attacker can exploit this vulnerability by crafting malicious requests that specify file paths leading to system-critical files such as wp-config.php, which contains database credentials and cryptographic keys essential for WordPress operation. When such files are deleted or modified, the consequences can range from complete application compromise to full system takeover, depending on the server configuration and file permissions. The vulnerability's severity is amplified by the fact that no authentication is required to exploit the flaw, making it particularly dangerous in publicly accessible environments where the plugin is deployed. This type of attack pattern aligns with ATT&CK technique T1059.007 for "Command and Scripting Interpreter: PowerShell" and T1486 for "Data Encrypted for Ransom" when considering the potential for broader system compromise.
Mitigation strategies for CVE-2025-4564 should prioritize immediate plugin version updates to the latest available release that addresses the path traversal vulnerability. Organizations should implement network-level restrictions to prevent access to the plugin's administrative interfaces and consider deploying web application firewalls with rules specifically designed to block path traversal attempts. The implementation of proper input validation and sanitization measures, including absolute path validation and whitelisting of allowed file operations, should be enforced within the plugin's codebase. Additionally, system administrators should conduct comprehensive file integrity monitoring to detect unauthorized deletions and establish automated backup procedures that can quickly restore critical files. The vulnerability demonstrates the critical importance of secure coding practices and proper input validation as outlined in OWASP Top Ten Proactive Controls, particularly Control 10 which emphasizes secure file handling and access control mechanisms. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in other plugins and themes that may present similar path traversal risks.