Description
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP-OliveCart Multiple Vulnerabilities (3.1.2)
MySQL CVE-2017-3331 Vulnerability (CVE-2017-3331)
MySQL CVE-2013-3809 Vulnerability (CVE-2013-3809)
WordPress Plugin Post Thumbnail Editor Multiple Cross-Site Request Forgery Vulnerabilities (2.4.1)
WordPress Plugin Disqus Comment System Multiple Vulnerabilities (2.75)