The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress
Information Disclosure
Orders Tracking For Woocommerce
Villatheme
NVD
WPScan
CVSS 3.1
2.7
EPSS
0.5%