Description (CNA)
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Veeqo for WooCommerce | affected 0 through 2.2.8 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.