PT-2025-6584 · Woocommerce · File Uploads Addon For Woocommerce
Tim Coen
·
Publicado
2025-02-18
·
Atualizado
2025-03-03
·
CVE-2024-13622
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
File Uploads Addon for WooCommerce versions up to, and including, 1.7.1
Description
The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, which can contain file attachments uploaded by customers. This is possible through the 'uploads' directory.
Recommendations
For versions up to, and including, 1.7.1, update to a version higher than 1.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the 'uploads' directory to minimize the risk of exploitation.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
File Uploads Addon For Woocommerce