CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
The Order Export & Order Import for WooCommerce plugin contains a path traversal vulnerability that allows high-privilege users to read arbitrary files from the server. An attacker with admin or equivalent access can bypass file restrictions and access sensitive files outside the intended directory. This affects versions up to 2.6.0.
What an attacker can do
Read arbitrary files from the server filesystem.
Potential impact on your site
A compromised admin account could expose sensitive configuration files, database credentials, or other private data stored on the server.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent) on the WordPress site.
Key dates
External resources
