Unauthorized Data Loss in WooCommerce Plugin Due to Missing Capability Check

CVE-2024-7258

Summary

The WooCommerce Google Feed Manager plugin for WordPress is prone to a significant security vulnerability that could result in unauthorized data loss. Specifically, the issue arises from the absence of vital capability checks within the 'wppfm_removeFeedFile' function. This flaw exists in all versions up to and including 2.8.0, enabling authenticated attackers with Contributor-level access or above to delete arbitrary files on the server. The risks escalate as the deletion of critical files, such as wp-config.php, could lead to remote code execution, putting the entire WordPress installation and sensitive data at risk.

References