CVE-2025-4564
Published: 15 May 2025
Summary
CVE-2025-4564 is a critical-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delpdf' action. The flaw affects all versions through 3.18 and is tracked as CWE-22 path traversal, enabling an attacker to supply crafted paths that escape intended directories on the underlying server.
Unauthenticated remote attackers can invoke the vulnerable action over the network without credentials or user interaction. By deleting critical files such as wp-config.php, an attacker can trigger remote code execution and fully compromise the WordPress site, consistent with the CVSS 9.8 rating.
Public references point to a fix published in WordPress plugin changeset 3292061 that updates the handling logic in wp-ticketbai.php. The Wordfence advisory further documents the precise location of the missing validation at line 240 and recommends immediate update or removal of the plugin.
EPSS remains flat at 0.0369 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15152
Vulnerability details
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to…
more
delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.