CVE-2024-10857: medium-severity vulnerability in tychesoftwares Product Input Fields for…
Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
35Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendcvss 6.5epss 0.8%
from disclosure to weapon
Published on NVDNov 26
VulnCheckNov 25
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
tychesoftwares · Product Input Fields for WooCommerceRelated CVEs — tychesoftwares Product Input Fields for…
In the same product, most dangerous first.