Mipl Wc Multisite Sync Vulnerabilities

The MIPL WC Multisite Sync plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.4.4

Fix:

No patched version reported

Disclosed:

Mar 1, 2026

CVE-2026-39705 on NVD →

The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information...

CVSS:

7.5

Affected:

up to 1.1.5

Fixed in:

1.1.6

Disclosed:

Jan 6, 2025

CVE-2024-12152 on NVD →