WordPress Product File Upload for WooCommerce Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the WordPress Product File Upload for WooCommerce plugin, specifically in versions through 2.2.4. This vulnerability allows for improper limitation of file upload paths, enabling malicious actors to traverse directories and potentially delete arbitrary files from the server. Such file deletion could disrupt the functionality of the website, especially if core files are targeted.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files from the website, causing potential disruption or malfunction of the site.

Remediation

Users of the WordPress Product File Upload for WooCommerce plugin should update to version 2.2.5 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.