Customer Reviews for WooCommerce by CusRev

Customer Reviews for WooCommerce by CusRev <= 5.15.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode

REPORT ID: abb3afc4-f957-4b67-b6c5-55e2fdc58c63

The plugin contains a Local File Inclusion (LFI) vulnerability due to the plugin does not sanitize comment_file attribute in the cusrev_reviews shortcode, which makes it possible for authenticated attackers with a role as low as contributor to include arbitrary files.

References

Source Code: https://wordpress.org/plugins/customer-reviews-woocommerce/

CVE: CVE-2023-0080

Attributes

Catgory: WordPress Plugin

Vulnerability Discovered: 2022-12-25

Report Published: 2023-01-23

Affected Version: <= 5.15.0

Classification

Type: Local File Inclusion (LFI)

Researcher

Name: István Márton

Email: [email protected]

Support Us?

We would truly appreciate it if you bought us a bunny (food for a snow leopard).