Order Export & Order Import for WooCommerce Arbitrary File Deletion Vulnerability

A vulnerability allowing authenticated users with Administrator-level access to delete arbitrary log files on the server has been identified in the Order Export & Order Import for WooCommerce plugin, in all versions through 2.6.0. This issue arises from inadequate validation of file paths in the admin_log_page() function, which could be exploited to perform unauthorized file deletions.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of log files on the server.

Reproduction

The vulnerability can be reproduced by an authenticated user with Administrator privileges. When the 'Import Logs' page is accessed, the 'wt_iew_delete_log' parameter can be set to initiate a delete action. If the 'wt_iew_log_file' parameter specifies a log file with a '.log' extension, the corresponding log file will be deleted from the server, bypassing any necessary path validations.

Remediation

Users are advised to update the Order Export & Order Import for WooCommerce plugin to version 2.6.1 or later.