CVE-2025-7359 is a path traversal vulnerability (CWE-22) in the Counter live visitors for WooCommerce plugin for WordPress, affecting all versions up to and including 1.3.6. The issue stems from insufficient validation of file paths in the wcvisitor_get_block function, enabling unauthenticated attackers to delete arbitrary files on the server. Unlike typical arbitrary file deletion vulnerabilities targeting single files, this flaw allows deletion of all files within an arbitrary directory, increasing the risk of significant data loss or denial of service. The vulnerability is remotely exploitable without authentication and requires no user interaction.

Successful exploitation leads to high-impact consequences including arbitrary deletion of multiple files within a directory on the affected server. This can cause loss of critical data and disrupt service availability, resulting in denial of service conditions. There is no confidentiality impact reported. The vulnerability is remotely exploitable by unauthenticated attackers, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official channels for updates or patches from the vendor danielriera. Implementing web application firewalls (WAF) with rules to detect and block path traversal attempts may provide temporary protection.