Description

WordPress Plugin Premmerce Permalink Manager for WooCommerce is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Premmerce Permalink Manager for WooCommerce version 2.3.10 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.3.11 or latest

References

https://github.com/truonghuuphuc/CVE-2024-27971-Note

https://plugins.svn.wordpress.org/woo-permalink-manager/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Multiple Cross-Site Request Forgery Vulnerabilities (2.5.6)

WordPress Plugin Newsletter Subscription Form Possible Remote Code Execution (1.1.2)

Oracle Database Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2007-5511)

Django Improper Input Validation Vulnerability (CVE-2014-0480)

Moodle Credentials Management Errors Vulnerability (CVE-2014-0008)

Severity

High

Classification

CVE-2024-27971 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion