Product Configurator for WooCommerce <= 1.2.31 - Arbitrary File Deletion
Strategic Overview
- Status
- Patched in 1.0.6
- Affected Plugin
- 3D Product configurator for WooCommerce
- Affected Version
<= 1.0.5- CVSS
- 5.4Medium
- Weakness type
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CVE
CVE-2022-1953
At a glance
CVE-2022-1953 is a medium-severity Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the 3D Product configurator for WooCommerce WordPress plugin, affecting versions <= 1.0.5. It carries a CVSS score of 5.4 (reachable over the network; low attack complexity). The issue is fixed in version 1.0.6; sites on affected versions should update now. Disclosed June 2022, reported by cydave.
Vulnerability Overview
The Product Configurator for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletions in versions up to, and including, 1.2.31 due to insufficient file validation and file path validation on the save_image() function that uses unlink() on a user supplied file path. This function is invoked via the wp_ajax_nopriv_mkl_pc_generate_config_image AJAX action which is tied to the generate_config_image() function with no capability checks or nonce validation which makes this issue exploitable via any unauthenticated user such as subscriber, or via a Cross-Site Request Forgery.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
3D Product configurator for WooCommerce <= 1.0.5 carries this weakness at save_image(), and reaching it takes a caller who can reach the endpoint. Path traversal happens when user-controlled text is used to build a filesystem path without being constrained to an intended directory, so sequences like ../ walk the resolved path somewhere else.
Depending on the operation, it means reading files outside the intended folder — wp-config.php being the usual target — or writing to and deleting paths the web server can touch. For 3D Product configurator for WooCommerce the fix is 1.0.6: builds <= 1.0.5 are affected, anything from 1.0.6 onward is not.
Remediation
Update to version 1.0.6, or a newer patched version
How does WordSec protect against this?
The attempt arrives as an ordinary request to 3D Product configurator for WooCommerce: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: 3D Product configurator for WooCommerce 1.0.6 closes this, and updating the plugin is the step that ends it.
- Firewall
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C