Description
WordPress Plugin WooCommerce is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin WooCommerce version 3.4.5 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 3.4.6 or latest
References
https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/
https://woocommerce.wordpress.com/2018/10/11/woocommerce-3-4-6-security-fix-release-notes/
Related Vulnerabilities
WordPress Plugin Stock market charts from finviz Cross-Site Scripting (1.0)
Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.17)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-35150)
Apache HTTP Server CVE-2024-38476 Vulnerability (CVE-2024-38476)
Joomla Improper Authentication Vulnerability (CVE-2022-23795)