Drag And Drop Multiple File Upload For Woocommerce
Monthly
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.