CVE-2024-35658: Arbitrary File Access in Checkout Field Editor

The Arbitrary File Access vulnerability allows an attacker to read or write files outside of the intended directory. This can be exploited to read sensitive configuration files, database credentials, or even upload malicious code. Successful exploitation could lead to complete server compromise, data theft, and denial of service. The ability to write files opens the door to remote code execution if the attacker can upload a web shell or modify existing PHP files. This vulnerability is particularly concerning given the popularity of WooCommerce and the potential for widespread exploitation.

1. Reserved2024-05-17
2. Published2024-06-10
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-35658 is to immediately upgrade the Checkout Field Editor for WooCommerce (Pro) plugin to version 3.6.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting file upload permissions within the WordPress environment or using a Web Application Firewall (WAF) to block requests containing path traversal sequences (e.g., ../). Regularly review file permissions and access logs for any suspicious activity. After upgrading, confirm the fix by attempting to access files outside the intended directory via a web browser – access should be denied.