Description (CNA)
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Admin and Customer Messages After Order for WooCommerce: OrderConvo | affected 0 through 15.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.