Description
WordPress Plugin WooCommerce is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin WooCommerce version 3.4.5 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 3.4.6 or latest
References
https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/
https://woocommerce.wordpress.com/2018/10/11/woocommerce-3-4-6-security-fix-release-notes/
Related Vulnerabilities
PostgreSQL Improper Validation of Array Index Vulnerability (CVE-2026-2006)
WordPress Plugin WP Discourse Unspecified Vulnerability (0.9.7)
WordPress Plugin Social Articles Security Bypass (2.4)
Apache Tomcat 7PK - Security Features Vulnerability (CVE-2002-0493)
Liferay Portal Missing Authorization Vulnerability (CVE-2025-43788)