IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
2.7Düşük

CVE-2025-1911Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function

webtoffee Product Import Export for WooCommerce – Import Export Product CSV Suite Yayım: (1 yıl önce)

Açıklama

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.

Zayıflık türü (CWE): CWE-73

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
webtoffee product import export for woocommerce < 2.5.1
webtoffee Product Import Export for WooCommerce – Import Export Product CSV Suite ≤ 2.5.0

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:* < 2.5.1

Aynı üründe son açıklar — WordPress plugins & themes

Puansız
CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…