Path Traversal in Membership For WooCommerce Plugin

Executive Summary

This vulnerability is a Path Traversal issue in the WordPress Membership For WooCommerce Plugin versions 3.1.0 and below. It allows unauthenticated attackers to delete arbitrary files from a website by improperly limiting access to restricted directories.

The vulnerability is classified as high severity with a CVSS score of 8.6 and falls under the OWASP Top 10 category of Broken Access Control.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can delete files from your website without authentication, which can cause the website to break or stop functioning.

Because the issue can be targeted in mass-exploit campaigns, thousands of websites could be affected regardless of their size or popularity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability allows unauthenticated attackers to delete files from a website using the Membership For WooCommerce plugin versions 3.1.0 and below.

Detection can involve monitoring for unusual file deletion activities or suspicious HTTP requests targeting the plugin's endpoints.

Specific commands or signatures are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Membership For WooCommerce plugin to version 3.1.1 or later, where the issue is patched.

Until the update can be applied, it is advised to implement the mitigation rule issued by Patchstack to block attacks targeting this vulnerability.

Useful 0 Not Useful 0