WP Wham Checkout Files Upload for WooCommerce Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the WP Wham Checkout Files Upload for WooCommerce plugin, specifically in versions through 2.2.5. This vulnerability arises from incorrectly configured access control security levels, potentially allowing unauthorized access to sensitive files or data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files or data, allowing attackers to interact with sensitive information or resources that should be protected.

Remediation

Users of the WP Wham Checkout Files Upload for WooCommerce plugin should update to version 2.2.6 or later. Patchstack users can enable auto-update for vulnerable plugins.