Technical impact
The vulnerability in Acowebs Woocommerce Custom Product Addons Pro permits an attacker to supply a crafted filename that bypasses the plugin’s directory restrictions, allowing deletion of arbitrary files on the server. This path traversal flaw can result in loss of critical data, configuration files, or application assets, potentially leading to service disruption or further compromise if the deleted files are part of the web application or system configuration. The weakness is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Affected Systems
Acowebs Woocommerce Custom Product Addons Pro plugin, version 5.9.0 and earlier, is impacted. The plugin is used within WordPress-based WooCommerce stores and specifically targets users who have installed versions up to and including 5.9.0.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity with potential for significant damage. The EPSS score is not available, so current exploitation likelihood is unknown, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is web-based, where an authenticated or potentially unauthenticated attacker submits a malicious payload through the plugin’s file handling functionality. Once the path traversal succeeds, the attacker can delete files, leading to disruptions or facilitating further attacks if the plugin runs with elevated privileges.
