Direct Download For Woocommerce
Monthly
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.