WordPress Woo File Dropzone Plugin Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the WordPress Woo File Dropzone plugin, specifically in versions through 1.1.7. This vulnerability allows for improper limitation of a pathname, potentially leading to arbitrary file deletion on the affected website.

Impact

Exploitation of this vulnerability could result in the deletion of files from the website. If core files are removed, it may cause the site to malfunction or become nonoperational.

Remediation

Users are advised to mitigate this vulnerability immediately. Patchstack has issued a mitigation rule to block attacks until an official patch is available. For more information on how to apply this mitigation, visit the Patchstack website.