The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the ‘tab’ parameter. Authenticated attackers with Administrator-level access can include and execute arbitrary files on the server, allowing for the execution of any PHP code. This vulnerability can be exploited to bypass access controls, obtain sensitive data, or achieve code execution through uploaded files.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.6 | CVE-2024-8393 |
Exploitation
To exploit this vulnerability, an authenticated attacker with Administrator-level access can manipulate the ‘tab’ parameter to include arbitrary files from the server. This can lead to the execution of malicious PHP code, allowing the attacker to bypass security measures and access sensitive information.
Affected Products
- Woocommerce Blocks – Woolook plugin (all versions up to 1.7.0): Vulnerable to Local File Inclusion via the ‘tab’ parameter, allowing execution of arbitrary files.
Mitigation
To mitigate this vulnerability, it is recommended to update the Woocommerce Blocks – Woolook plugin to the latest version. Additionally, restricting access to the plugin settings and implementing proper input validation can help prevent exploitation.