BigBuy Dropshipping Connector for WooCommerce Full Path Disclosure Vulnerability

A full path disclosure vulnerability has been identified in the BigBuy Dropshipping Connector for WooCommerce plugin, affecting all versions prior to and including 2.0.0. The vulnerability arises because the 'generate-default.php' file in the '/vendor/cocur/slugify/bin/' directory is directly accessible, leading to an error that reveals the full path of the web application. This information could assist in exploiting other vulnerabilities, although on its own, it is not harmful and requires the presence of another vulnerability to cause damage to the website.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to access the full file path of the WordPress installation, which could be used to facilitate further attacks, especially if other vulnerabilities are present.

Remediation

Users are advised to update the BigBuy Dropshipping Connector for WooCommerce plugin to version 2.0.1 or a later patched version.