Description
WordPress Plugin WooCommerce is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin WooCommerce version 3.4.5 is vulnerable; prior versions are also affected.
Remediation
Update to plugin version 3.4.6 or latest
References
https://blog.ripstech.com/2018/wordpress-design-flaw-leads-to-woocommerce-rce/
https://woocommerce.wordpress.com/2018/10/11/woocommerce-3-4-6-security-fix-release-notes/
Related Vulnerabilities
MySQL CVE-2017-10284 Vulnerability (CVE-2017-10284)
e107 Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-2099)
WordPress Plugin WPS Cleaner Multiple Cross-Site Request Forgery Vulnerabilities (1.4.4)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2947)