Aller au contenu
Se connecter
6.5 Moyenne

CVE-2024-10857 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up…

Description

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Produits et versions touchés

Produit Versions touchées Corrigé en
Product Input Fields for WooCommerce 1.9 premières → 1.9 Pas de correctif indiqué

Autres CVE de Product Input Fields for WooCommerce

Les 3 CVE de Product Input Fields for WooCommerce →
CVE-2024-13359 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to… 8.1 Élevée CVE-2020-36696 The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing… 7.5 Élevée
Suivre cette CVE