What the vulnerability does
01Description
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. The arbitrary file download was patched in 7.5.1, while the missing authorization was corrected in version 7.6.2.
Explanation of Vulnerability in Simple Terms
02Summary
The Mercado Pago payments for WooCommerce plugin versions 7.3.0 through 7.6.1 contain a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with a low-privilege account can access sensitive files outside the intended directory structure. Update to a version newer than 7.6.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including configuration files and other sensitive data.
Potential impact on your site
04Site Impact
Sensitive files like database credentials, API keys, and configuration data could be exposed to authenticated users.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WooCommerce site (e.g., customer or subscriber).
Key dates
06Disclosure timeline
July 20, 2024
CVE published
August 1, 2024
Record updated
