WordPress Plugin Vulnerabilities

WooCommerce < 6.2.1 - Path Traversal via Importers

Description

The plugin does not properly check for path traversal when importing tax rates. There are limited details at this stage and this advisory will be updated later on

Affects Plugins

Plugin icon
woocommerce
Fixed in 6.2.1

References

URL
https://plugins.trac.wordpress.org/changeset/2683324
URL
https://developer.woocommerce.com/2022/02/22/woocommerce-6-2-1-security-fix/

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
5.5 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
26e169da-4020-4b3d-8bee-af01bd853791

Timeline

Publicly Published
2022-02-23 (about 4 years ago)
Added
2022-02-23 (about 4 years ago)
Last Updated
2022-04-12 (about 3 years ago)

Other

Published
Title
Published
2023-11-13
Title
Frontend File Manager < 22.7 - Editor+ Arbitrary File Download
Published
2022-09-06
Title
BackupBuddy < 8.7.5 - Unauthenticated Arbitrary File Access
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ RCE
Published
2025-02-13
Title
Bit Assist < 1.5.3 - Admin+ Arbitrary File Read
Published
2021-07-05
Title
Haxcan <= 1.0.0 - Arbitrary File Access