CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments uploaded by customers.
Explanation of Vulnerability in Simple Terms
The File Uploads Addon for WooCommerce versions 1.7.1 and earlier expose sensitive file information to unauthenticated attackers over the network. An attacker can read details about uploaded files without logging in or user interaction. This affects all sites running the vulnerable plugin. Update to a version newer than 1.7.1 to resolve the issue.
What an attacker can do
Read sensitive information about uploaded files without authentication.
Potential impact on your site
Attackers can discover and access details about customer file uploads without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
