Threats tagged 'ghsa-xw2r-p69h-9jmx'

The Vanquish Upload Files for WooCommerce plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 2.7.13. Authenticated users with subscriber-level access or higher can exploit this flaw via the 'vanupfi_file_name' parameter to read arbitrary files on the server. The vulnerability arises from an authorization bypass triggered by supplying a non-existent order ID, which causes an internal check to be bypassed. A traversal payload can then be used to access sensitive files such as wp-config.php.