WooCommerce Plugin Vulnerable to Directory Traversal

CVE-2024-10857

What is CVE-2024-10857?

The Product Input Fields for WooCommerce plugin for WordPress has a directory traversal vulnerability in the handle_downloads() function. This flaw arises from inadequate file path validation and sanitization. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to access arbitrary files on the server, potentially exposing sensitive data. This risk emphasizes the importance of securing file handling processes within WordPress plugins to protect user data and maintain the integrity of the web application.

References