WooODT Lite Full Path Disclosure Vulnerability

A full path disclosure vulnerability exists in the WooODT Lite – Delivery & Pickup Date Time Location for WooCommerce plugin for WordPress, affecting all versions through 2.5.1. The vulnerability arises because the 'bycwooodt_get_all_orders.php' file is publicly accessible and can generate error messages visible to users. This exposure allows unauthenticated attackers to retrieve the full path of the web application, potentially aiding in the exploitation of other vulnerabilities. While the disclosed information alone is not harmful, it could be used in conjunction with another vulnerability to compromise an affected website.

Impact

Exploitation of this vulnerability allows for full path disclosure, which could assist in exploiting other vulnerabilities on the site.

Remediation

Users are advised to update the WooODT Lite – Delivery & Pickup Date Time Location for WooCommerce plugin to version 2.5.2 or a newer patched version.