CVE-2025-69131
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The WordPress & WooCommerce Scraper plugin versions <= 1.0.7 allows unauthenticated arbitrary file downloads. This issue arises from improper input validation.
Risk Assessment
An attacker could exploit this vulnerability to download sensitive files from the server, potentially leading to data exposure or system compromise.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and conduct a security audit of the server.
Other vulnerabilities in WordPress & WooCommerce Scraper Plugin
See all- CVE-2025-69129Critical
The WordPress & WooCommerce Scraper plugin versions <= 1.0.7 allows unauthenticated arbitrary file uploads.
- CVE-2025-62088Medium
The WordPress & WooCommerce Scraper Plugin up to version 1.0.7 has a Server-Side Request Forgery (SSRF) vulnerability. This allows sending requests from the server to internal resources, which can lead to exposure of sensitive information.
Original NVD description (English source)
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS