CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File Inclusion.This issue affects WooCommerce Pickupp: from n/a through <= 2.4.3.
Explanation of Vulnerability in Simple Terms
WooCommerce Pickupp versions up to 2.4.3 contain a path traversal vulnerability that allows an attacker to read, modify, or delete files on the server outside the intended directory. No authentication or user interaction is required. An attacker can exploit this over the network to access sensitive configuration files, database credentials, or other protected data.
What an attacker can do
Read, modify, or delete files on the server outside the plugin's intended directory.
Potential impact on your site
Attackers can access sensitive files like wp-config.php, steal database credentials, or modify site files without logging in.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
