Back to search
CVE-2023-4216
Published: Sep 4, 2023
Modified: Apr 23, 2025
PUBLISHED
Description
The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file.
| Vendor | Product | Versions |
|---|---|---|
Unknown | Orders Tracking for WooCommerce | affected 0 - < 1.2.6 |
References
https://wpscan.com/vulnerability/8189afc4-17b3-4696-89e1-731011cb9e2b
exploit
vdb-entry
technical-description
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now