What the vulnerability does
01Description
The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2024-49249 is likely a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
02Summary
SMSA Shipping versions 2.3 and earlier contain a vulnerability allowing authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The flaw requires network access and valid login credentials but no additional user interaction. All three impact categories (confidentiality, integrity, availability) are affected.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify content, or disrupt the shipping service.
Potential impact on your site
04Site Impact
Authenticated users can access confidential information, alter shipping records, or cause service outages.
Conditions required to exploit
05Prerequisites
Valid login account with low-level privileges and network access to the site.
Key dates
06Disclosure timeline
December 21, 2024
CVE published
April 8, 2026
Record updated
