CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce cities-shipping-zones-for-woocommerce allows PHP Local File Inclusion.This issue affects Cities Shipping Zones for WooCommerce: from n/a through <= 1.2.7.
Explanation of Vulnerability in Simple Terms
Cities Shipping Zones for WooCommerce versions up to 1.2.7 contain a path traversal vulnerability that allows high-privileged users to read or modify arbitrary files on the server. An attacker with administrator or equivalent access can exploit this to access sensitive configuration files, database credentials, or other protected data outside the intended plugin directory.
What an attacker can do
Read or modify arbitrary files on the server outside the plugin directory.
Potential impact on your site
A malicious admin or compromised admin account can access sensitive files, steal credentials, or alter site configuration.
Conditions required to exploit
Attacker must have high-level privileges (administrator or equivalent role) on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
