Product Import Export for WooCommerce Directory Traversal Vulnerability Allowing Arbitrary File Read

A directory traversal vulnerability has been identified in the Product Import Export for WooCommerce - Import Export Product CSV Suite plugin for WordPress, affecting all versions through 2.5.0. The vulnerability arises in the download_file() function, where authenticated attackers with Administrator-level access can exploit the flaw to read arbitrary log files on the server, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability allows authenticated users with Administrator privileges to read sensitive data from arbitrary log files on the server.

Reproduction

The vulnerability can be reproduced by an authenticated user with Administrator access. The user can initiate a log file download through the WordPress admin interface, which triggers the vulnerable download_file() function. This function does not properly validate file paths, allowing for directory traversal attacks that can access sensitive log files outside the intended directory.

Remediation

Users are advised to update the Product Import Export for WooCommerce - Import Export Product CSV Suite plugin to version 2.5.1 or later.