Paper/Archive/CVE-2024-39651

CVE-2024-39651

WPWeb WooCommerce PDF Vouchers — WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability

EPSS 0.5%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (NVD)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 42.6.426 × 208.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.

Affected

ProductAffectedFixed inSource

WooCommerce PDF Vouchersn/a – < 4.9.54.9.5CNA

woocommerce_pdf_vouchers< 4.9.54.9.5CISA-ADP

Scores by source

NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

Patchstack (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refpatchstack.com/database/vulnerability/woocommerce-pdf-vouchers/wordpress-woocommerce-pdf-vouchers-plugin-4-9-5-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve