PT-2024-10891 · WordPress · Currency Switcher For Woocommerce

Marc Montpas · Published 2024-01-16 · Updated 2024-10-23 · CVE-2021-24566

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce Currency Switcher FOX WordPress plugin versions prior to 1.3.7

Description The issue concerns a Local File Inclusion (LFI) vulnerability. LFI is a type of attack where an attacker can trick the application into exposing or running files on the server that they shouldn't have access to. This vulnerability can be exploited via the woocs shortcode.

Recommendations For versions prior to 1.3.7, update to version 1.3.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the woocs shortcode until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-24566

Affected Products

Currency Switcher For Woocommerce

References · 7

• 🔥 https://jetpack.com/2021/07/22/severe-vulnerability-patched-in-woocommerce-currency-switcher · Exploit
• 🔥 https://wpscan.com/vulnerability/a0bc4b13-53fe-462d-8306-8915196d3a5a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24566 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24566 · Vendor Advisory
• https://t.me/cvenotify/99191 · Telegram Post
• https://twitter.com/CVEnew/status/1747293186568155574 · Twitter Post
• https://t.me/cvenotify/68412 · Telegram Post