NotFound XLSXviewer Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the NotFound XLSXviewer WordPress plugin, specifically in versions through 2.1.1. This vulnerability allows for improper limitation of file paths, enabling attackers to traverse directories and potentially delete arbitrary files from the server.

Impact

Exploitation of this vulnerability could lead to the deletion of important files from the WordPress site, including core files, which could disrupt the site's functionality.

Remediation

Users of the NotFound XLSXviewer WordPress plugin are advised to update to version 2.1.1 or later. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.