CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
Purchase Orders for WooCommerce versions 1.0.2 and earlier contain a path traversal vulnerability that allows authenticated attackers to read and modify arbitrary files on the server. An attacker with low-level access can navigate outside intended directories to access sensitive data or alter critical files, compromising site integrity and confidentiality.
What an attacker can do
Read and modify arbitrary files on the server outside the intended directory structure.
Potential impact on your site
Attackers with basic user accounts can steal sensitive files (config, database backups) or alter site files, potentially leading to data breach or site takeover.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., customer or subscriber role) on the WooCommerce site.
Key dates
External resources
