CVE-2018-8711
Critical
Description
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWoocommerce-filter Woocommerce Products Filter
PublishedMar 14, 2018
First seenMar 14, 2018
How to fix
Update
- woocommerce-filter woocommerce_products_filter2.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| woocommerce-filter woocommerce_products_filter | v < 2.2.0 | 2.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.