Aramex Shipping WooCommerce <= 1.1.21 - Unauthenticated Full Path Disclosure
mediumThe Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has display_errors enabled. This makes it possible for unauthenticated attackers to retri...
- CVSS:
- 5.3
- Affected:
- up to 1.1.21
- Fix:
- No patched version reported
- Disclosed:
- Jul 26, 2024