Advanced Product Fields Extended For Woocommerce
Monthly
Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.