CVE-2024-12152 HIGH

CVE-2024-12152: MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download

Vendor Mulika
Product MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders.
Weakness CWE-22 · Path traversal
Published January 7, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Key dates

02Disclosure timeline

January 7, 2025 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-28208 Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix CVE-2026-27886 Strapi may leak sensitive data via relational filtering due to lack of query sanitization CVE-2024-28073 SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability CVE-2026-49233 Routinator cache path traversal using rogue rsync URIs CVE-2025-32926 WordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability