Linet Erp Woocommerce Integration Vulnerabilities

The Linet ERP-Woocommerce Integration Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitra...

CVSS:

7.2

Affected:

up to 3.5.12

Fixed in:

3.6.0

Disclosed:

Apr 10, 2025

CVE-2025-31411 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Aribhour Linet ERP-Woocommerce Integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through 3.5.12.

Affected:

up to 3.5.12

Fix:

No patched version reported

Disclosed:

Apr 10, 2025

CVE-2025-31411 on NVD →

The Linet ERP-Woocommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request...

CVSS:

4.3

Affected:

up to 3.5.7

Fixed in:

3.5.8

Disclosed:

Jan 24, 2025

CVE-2025-24594 on NVD →

[en] Missing Authorization vulnerability in Speedcomp Linet ERP-Woocommerce Integration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Linet ERP-Woocommerce Integration: from n/a through 3.5.7.

Affected:

up to 3.5.8

Fixed in:

3.5.8

Disclosed:

Jan 24, 2025

CVE-2025-24594 on NVD →