WooCommerce Plugin Vulnerable to Directory Traversal

CVE-2024-10857

What is CVE-2024-10857?

The Product Input Fields for WooCommerce plugin for WordPress has a directory traversal vulnerability in the handle_downloads() function. This flaw arises from inadequate file path validation and sanitization. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to access arbitrary files on the server, potentially exposing sensitive data. This risk emphasizes the importance of securing file handling processes within WordPress plugins to protect user data and maintain the integrity of the web application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References