WordPress Aviation Weather from NOAA Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the WordPress plugin Aviation Weather from NOAA, affecting versions through 0.7.2. This vulnerability allows for improper limitation of file paths, potentially leading to arbitrary file deletion on the affected website.

Impact

Exploitation of this vulnerability could result in the deletion of arbitrary files from the website, including core files, which could disrupt the site's functionality.

Remediation

Users are advised to update to a version later than 0.7.2. Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability. For more information on how to apply this virtual patch, visit the Patchstack website.