Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
highThe Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server....
- CVSS:
- 8.2
- Affected:
- up to 1.3.6
- Fixed in:
- 1.3.7
- Disclosed:
- Jul 15, 2025