woocommerce-csvimport 3.3.6 – Authenticated Arbitrary File Deletion

Description

Type user access: any user registered.

$_POST['filename'] is not escaped.
Code
File: wp-content/plugins/woocommerce-csvimport/export/include/classes/woocsvExport.php Line:64
public function delete_export_file() {

if ( isset( $_POST['filename'] ) ) {
@unlink( $_POST['filename'] );
}
wp_die( 0 );
}

Result:

wp-config.php file deleted and restart the all system.