Description
WordPress Plugin Wholesale Market for WooCommerce is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Wholesale Market for WooCommerce version 1.0.8 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.0.0 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:51E023DE-189D-4557-9655-23F7BA58B670
https://woocommerce.com/products/wholesale-market-for-woocommerce/
Related Vulnerabilities
WordPress Plugin MP3-jPlayer Local File Disclosure (2.3)
WordPress Plugin Soundy Audio Playlist Cross-Site Scripting (4.6)
WordPress Plugin Stripe For WooCommerce Security Bypass (3.3.9)
WordPress Plugin File Manager Information Disclosure (6.4)
WordPress 2.0.5 Invalid CSRF Token Cross-Site Scripting Vulnerability (0.6.2 - 2.0.5)