Overview
The Counter live visitors for WooCommerce plugin for WordPress, a widely used e-commerce solution, has recently been identified as having a significant security vulnerability. This vulnerability, catalogued as CVE-2025-7359, is present in all versions up to, and including, 1.3.6. It enables attackers to delete arbitrary files on the server, potentially causing data loss or a denial of service condition. Given the widespread usage of WordPress and WooCommerce, this vulnerability presents a substantial risk to a significant number of websites and their users.
Vulnerability Summary
CVE ID: CVE-2025-7359
Severity: High (8.2 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Data Loss, Denial of Service, Potential System Compromise or Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Counter live visitors for WooCommerce Plugin | Up to and including 1.3.6
How the Exploit Works
The vulnerability exists due to insufficient file path validation in the wcvisitor_get_block function. An attacker could exploit this vulnerability by sending a specially crafted request to the server, which would allow them to delete any file present on the server. This could result in the loss of critical data or cause a denial of service by deleting system files, thereby causing the system to malfunction or become unavailable.
Conceptual Example Code
An example of a malicious request exploiting the vulnerability might look like this:
POST /wcvisitor_get_block HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "file_path": "/path/to/arbitrary/directory/*" }Mitigation
To protect against this vulnerability, users of the Counter live visitors for WooCommerce plugin should update to the latest version as soon as possible. If an update is not immediately available, consider using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure. These can help block malicious requests that attempt to exploit this vulnerability.