Product Configurator for WooCommerce <= 1.2.31 - Arbitrary File Deletion
mediumThe Product Configurator for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletions in versions up to, and including, 1.2.31 due to insufficient file validation and file path validation on the save_image() function that uses unlink() on a user supplied file path. This function is invoked via the wp_...
- CVSS:
- 5.4
- Affected:
- up to 1.0.5
- Fixed in:
- 1.0.6
- Disclosed:
- Jun 1, 2022