Overview
In the realm of cybersecurity, the discovery of new vulnerabilities is a common occurrence. CVE-2025-4564 is one such vulnerability that poses a significant threat to WordPress websites that employ the TicketBAI Facturas para WooCommerce plugin. The vulnerability, which arises from insufficient file path validation, allows unauthenticated attackers to delete arbitrary files on the server. With a severity score of 9.8, it’s a critical issue that requires immediate attention from webmasters and developers alike.
The gravity of this vulnerability lies in its potential to lead to remote code execution. An attacker can exploit this vulnerability to delete vital files such as wp-config.php, which can easily compromise the entire system or lead to data leakage. This makes it a significant threat to any organization that relies on this popular eCommerce plugin for their WordPress websites.
Vulnerability Summary
CVE ID: CVE-2025-4564
Severity: Critical (9.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
TicketBAI Facturas para WooCommerce Plugin | Up to and including 3.18
How the Exploit Works
The vulnerability arises from insufficient file path validation in the ‘delpdf’ action of the TicketBAI Facturas para WooCommerce plugin. This allows an unauthenticated attacker to send a specially crafted request to delete arbitrary files on the server. The severity of the impact depends on the nature of the deleted file. For instance, deletion of the wp-config.php file can lead to remote code execution, thereby compromising the entire system.
Conceptual Example Code
An attacker could exploit this vulnerability using a HTTP request like the following:
GET /wp-content/plugins/ticketbai-facturas-para-woocommerce/delpdf.php?file=../../wp-config.php HTTP/1.1
Host: target.example.comIn this example, the attacker is attempting to delete the wp-config.php file, which is the central configuration file for WordPress. If successful, this could lead to a full system compromise.
Mitigation Guidance
The immediate action for mitigating this vulnerability is to apply the vendor patch. If the patch is not available or cannot be applied immediately, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. Additionally, regular updates and security audits can help prevent the exploitation of such vulnerabilities in the future.