Description
WordPress Plugin WooCommerce is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin WooCommerce version 3.4.5 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 3.4.6 or latest
References
https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/
https://woocommerce.wordpress.com/2018/10/11/woocommerce-3-4-6-security-fix-release-notes/
Related Vulnerabilities
WordPress Plugin Social Sharing-Sassy Social Share Cross-Site Scripting (3.3.39)
WordPress Plugin Instagram Feed Unspecified Vulnerability (1.11.3)
Apache Traffic Server Improper Authentication Vulnerability (CVE-2021-38161)
WordPress Plugin FireDrum Email Marketing PHP Object Injection (1.47)
WordPress Plugin WP eCommerce Multiple Unspecified Vulnerabilities (3.9.3)