PT-2024-16596 · WordPress · Product Input Fields For Woocommerce

1337_Wannabe + 1 · Published 2024-11-26 · Updated 2025-07-09 · CVE-2024-10857

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Product Input Fields for WooCommerce plugin for WordPress versions up to, and including, 1.9

Description The issue allows authenticated attackers with Contributor-level access and above to read the contents of arbitrary files on the server, potentially containing sensitive information, due to insufficient file path validation/sanitization in the handle downloads() function.

Recommendations For versions up to, and including, 1.9, consider disabling the handle downloads() function as a temporary workaround until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2024-10857

Affected Products

Product Input Fields For Woocommerce

References · 6

• https://plugins.trac.wordpress.org/changeset/3195423/product-input-fields-for-woocommerce/trunk?contextall=1&old=3173573&old_path=%2Fproduct-input-fields-for-woocommerce%2Ftrunk · Patch
• https://osv.dev/vulnerability/CVE-2024-10857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10857 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e45207af-3886-4d95-9cd8-5ecdc683dc58?source=cve · Note
• https://twitter.com/CVEnew/status/1861307655530389867 · Twitter Post
• https://t.me/cvenotify/128238 · Telegram Post