Arture B.V. StoreContrl WooCommerce Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Arture B.V. StoreContrl WooCommerce plugin, affecting versions through 4.1.3. This vulnerability allows for arbitrary file download, enabling malicious actors to download any file from the website, including sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized downloading of files from the affected website, potentially including sensitive information or credentials.

Remediation

Users of the StoreContrl WooCommerce plugin should update to version 4.1.4 or later. Patchstack users can enable auto-update for vulnerable plugins.