Cart66 Lite - WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure

Reaching this weakness in Cart66 Lite : < 1.5.4 takes a caller who can reach the endpoint. Path traversal happens when user-controlled text is used to build a filesystem path without being constrained to an intended directory, so sequences like ../ walk the resolved path somewhere else.

Depending on the operation, it means reading files outside the intended folder — wp-config.php being the usual target — or writing to and deleting paths the web server can touch. For Cart66 Lite : the fix is 1.5.4: builds < 1.5.4 are affected, anything from 1.5.4 onward is not.