CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through <= 8.6.
Explanation of Vulnerability in Simple Terms
Checkout Mestres WP versions 8.6 and earlier contain a path traversal vulnerability that allows high-privilege users to read, write, or delete arbitrary files on the server. An attacker with admin or elevated access can exploit this to access sensitive configuration files, modify site content, or disable the site entirely. Update immediately to a version newer than 8.6.
What an attacker can do
Read, write, or delete arbitrary files on the server filesystem.
Potential impact on your site
A compromised admin account can be used to access database credentials, modify core files, or destroy site data.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent) on the site.
Key dates
External resources
Related vulnerabilities
