Directory Traversal Vulnerability in TheCartPress Plugin for WordPress

CVE-2015-3301

Summary

A directory traversal vulnerability exists in TheCartPress eCommerce Shopping Cart plugin for WordPress prior to version 1.3.9.3. This flaw allows remote administrators to exploit the tcp_box_path parameter on the checkout_editor_settings page, leading to unauthorized access to arbitrary files on the server by leveraging the .. (dot dot) path traversal technique. This can potentially expose sensitive information stored on the server, thereby increasing the risk of further attacks.

References