Description
WordPress Plugin WooCommerce is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin WooCommerce version 3.4.5 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 3.4.6 or latest
References
https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/
https://woocommerce.wordpress.com/2018/10/11/woocommerce-3-4-6-security-fix-release-notes/