Oxygen MyData for WooCommerce Path Traversal Vulnerability

A path traversal vulnerability has been identified in the Oxygen MyData for WooCommerce plugin, affecting versions through 1.0.63. This vulnerability allows for improper limitation of a pathname to a restricted directory, potentially leading to arbitrary file deletion.

Impact

Exploitation of this vulnerability could allow a malicious actor to delete arbitrary files from the website, including core files, which could disrupt the site's functionality.

Remediation

Users of the Oxygen MyData for WooCommerce plugin should update to version 1.0.65 or later. Patchstack users can enable auto-updates for vulnerable plugins.