PT-2024-30435 · Elementor · Woo Products Widgets For Elementor

João Pedro S Alcântara · Published 2024-08-19 · Updated 2024-08-23 · CVE-2024-43271

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woo Products Widgets For Elementor versions n/a through 2.0.0

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local File Inclusion. This vulnerability affects Woo Products Widgets For Elementor, enabling potential attackers to access and include local files, posing a risk to cybersecurity.

Recommendations For Woo Products Widgets For Elementor versions n/a through 2.0.0, consider disabling the vulnerable component until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using vulnerable functions or parameters that may be associated with the Path Traversal issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-43271

Affected Products

Woo Products Widgets For Elementor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-43271 · Security Note
• https://t.me/cvedetector/3542 · Telegram Post
• https://patchstack.com/database/vulnerability/woo-products-widgets-for-elementor/wordpress-widgets-for-woocommerce-products-on-elementor-plugin-2-0-0-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1827006502839660696 · Twitter Post
• https://twitter.com/cracbot/status/1826862081335066652 · Twitter Post
• https://twitter.com/CVEnew/status/1825591357064241390 · Twitter Post
• https://twitter.com/cracbot/status/1827224422891299125 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1825640413232816526 · Twitter Post