CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
Explanation of Vulnerability in Simple Terms
Google for WooCommerce versions up to 2.8.6 lack proper authorization checks, allowing unauthenticated attackers to read sensitive information. An attacker can access data without logging in or requiring user interaction. Site owners should update immediately to prevent unauthorized data disclosure.
What an attacker can do
Read sensitive information without logging in.
Potential impact on your site
Unauthorized users can access sensitive data exposed by the plugin.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
