CVE-2024-10857

6.5 mediumEPSS 0.8%

Medium (6.5) in tychesoftwares product input fields for woocommerce. EPSS 0.8% chance of exploitation in the next 30 days.

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-35
Published: 2024-11-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tychesoftwares:product_input_fields_for_woocommerce

References

https://plugins.trac.wordpress.org/changeset/3195423/product-input-fields-for-woocommerce/trunk?contextall=1&old=3173573&old_path=%2Fproduct-input-fields-for-woocommerce%2Ftrunk
https://www.wordfence.com/threat-intel/vulnerabilities/id/e45207af-3886-4d95-9cd8-5ecdc683dc58?source=cve

Check your stack JSON