WordPress Global Gateway e4 Plugin <= 2.0 - Arbitrary File Deletion vulnerability

The Arbitrary File Access vulnerability allows an attacker to read any file accessible by the web server process. This includes configuration files, source code, database credentials, and potentially even user data. Successful exploitation could lead to complete compromise of the system, data exfiltration, and further malicious activity. The impact is amplified if the gateway is used to process sensitive financial information, as attackers could gain access to payment card details or other personally identifiable information (PII).

WordPress websites utilizing the Global Gateway e4 | Payeezy Gateway plugin, particularly those running versions 2.0 or earlier, are at significant risk. Shared hosting environments where file permissions are not strictly controlled are also more vulnerable, as an attacker could potentially leverage this vulnerability to access files belonging to other users on the same server.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/global-gateway-e4-payeezy-gateway/

• generic web:

curl -I 'https://your-website.com/../../../../etc/passwd' # Check for file disclosure

1. 2024-11-14Disclosure

   disclosure

1. Reserviert2024-11-11
2. Veröffentlicht2024-11-14
3. Geändert2024-11-15
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade to version 2.0.1, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing temporary workarounds such as restricting file access permissions on the server and implementing strict input validation to prevent path traversal attacks. Web Application Firewalls (WAFs) can be configured with rules to block requests containing suspicious path manipulation attempts. Regularly review and update server configurations to minimize the attack surface.