Ppom Product Addons Custom Fields For Woocommerce
Monthly
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.