CVE-2024-27971: Path Traversal in Premmerce Permalink Manager

The core impact of CVE-2024-27971 lies in its potential for PHP Local File Inclusion (LFI). An attacker exploiting this vulnerability could craft a malicious URL that manipulates the plugin's file handling logic, causing it to include files outside of the intended directory. This could allow an attacker to read sensitive configuration files, source code, or even execute arbitrary PHP code on the server. The blast radius extends to the entire server if the attacker can successfully execute code, potentially compromising the entire WooCommerce store and its associated data. Successful exploitation could lead to data breaches, website defacement, and complete system takeover.

1. Reserved2024-02-28
2. Published2024-05-17
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-27971 is to immediately upgrade the Premmerce Permalink Manager for WooCommerce plugin to version 2.3.11 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting file access permissions on the server. Specifically, ensure that the web server user does not have write access to directories outside of the plugin's designated directory. Web Application Firewall (WAF) rules can also be configured to block requests containing suspicious path traversal patterns, such as double dots (..) or absolute paths. After upgrading, verify the fix by attempting to access files outside the intended directory through the plugin's URL parameters; the request should be denied.

Active installs

50KNiche

Plugin rating