The vulnerability identified as CVE-2025-54029 affects the extendons WooCommerce csv import export plugin (versions ≤ 2.0.6). It is classified as an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with low privileges to craft file paths that escape intended directory restrictions, potentially leading to denial of service conditions. The CVSS 3.1 base score is 7.7, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, and impact limited to availability loss.

This vulnerability can be exploited remotely by an attacker with low privileges to cause denial of service, impacting the availability of the affected WooCommerce csv import export plugin. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the plugin functionalities to trusted users only and monitor for unusual activity related to file import/export operations.