WooCommerce Plugin Vulnerable to Directory Traversal
CVE-2024-10857

6.5MEDIUM

Key Information:

Vendor
Tychesoftwares
Status
Product Input Fields For WooCommerce
Vendor
CVE Published:
26 November 2024

Summary

The Product Input Fields for WooCommerce plugin for WordPress has a directory traversal vulnerability in the handle_downloads() function. This flaw arises from inadequate file path validation and sanitization. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to access arbitrary files on the server, potentially exposing sensitive data. This risk emphasizes the importance of securing file handling processes within WordPress plugins to protect user data and maintain the integrity of the web application.

Affected Version(s)

Product Input Fields for WooCommerce * <= 1.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3195423/prod...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AmrAwad
.