Skip to content
Sign in
6.5 Medium

CVE-2024-10857 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up…

Description

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products and versions

Product Affected versions Fixed in
Product Input Fields for WooCommerce 1.9 earliest → 1.9 No fix stated

Other CVEs of Product Input Fields for WooCommerce

The 3 CVEs of Product Input Fields for WooCommerce →
CVE-2024-13359 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to… 8.1 High CVE-2020-36696 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing… 7.5 High
Track this CVE