Description (CNA)
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / File Uploads Addon for WooCommerce | affected 1.7.2 through 1.7.6 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.