WordPress Checkout Field Editor for WooCommerce (Pro) Plugin <= 3.6.2 - Unauthentifizierte Arbiträre Dateilöschung Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to read or write files outside of the intended directory. This can be exploited to read sensitive configuration files, source code, or even upload malicious files to the server. Successful exploitation could lead to complete system compromise, data breaches, and denial of service. The attacker could potentially gain access to customer data, payment information, and other sensitive details stored on the WooCommerce server. While the specific attack surface is limited to the plugin's functionality, the potential impact is significant due to the sensitive nature of e-commerce data.

Websites using WooCommerce with the Checkout Field Editor for WooCommerce (Pro) plugin, particularly those running older versions (≤3.6.2), are at significant risk. Shared hosting environments are especially vulnerable, as they often have limited access controls and a higher concentration of WooCommerce installations.

• wordpress / composer / npm:

grep -r '../' /var/www/html/wp-content/plugins/checkout-field-editor-for-woocommerce-pro/*

• generic web:

curl -I 'https://your-website.com/wp-content/plugins/checkout-field-editor-for-woocommerce-pro/../../../../etc/passwd' # Check for directory traversal

1. 2024-06-10Disclosure

   disclosure

1. Reserviert2024-05-17
2. Veröffentlicht2024-06-10
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-35658 is to immediately upgrade the Checkout Field Editor for WooCommerce (Pro) plugin to version 3.6.3 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Restrict file upload permissions for the plugin's user account to the minimum necessary. Regularly review file system permissions and ensure that sensitive files are not publicly accessible. After upgrading, confirm the fix by attempting a path traversal attack via the plugin's file upload functionality; it should be blocked.