Themecomplete
Monthly
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.