CVE-2024-35658 - WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability

Back Back to CVE browser

CRITICAL

WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability

Published Jun 10, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 0.59%

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File Manipulation.This issue affects Checkout Field Editor for WooCommerce (Pro): from n/a through 3.6.2.

Affected products

Vendor ThemeHigh Product Checkout Field Editor for WooCommerce (Pro) Default
unaffected
Affected
- ≤ 3.6.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
ThemeHigh	Checkout Field Editor for WooCommerce (Pro)	unaffected	Affected ≤ 3.6.2

Remediation

Vendor solution

Update to 3.6.3 or a higher version.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-35417		Advisory
https://patchstack.com/database/vulnerability/woocommerce-checkout-field-editor-pro/wordpress-checkout-field-editor-for-woocommerce-pro-plugin-3-6-2-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve		vdb-entryThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Patchstack

Published Jun 10, 2024

Updated Apr 28, 2026

Reserved May 17, 2024

Link CVE-2024-35658

CISA Vulnrichment

Updated Jun 11, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2024-35658

Red Hat

No data

ENISA EUVD

Assigner Patchstack

Published Jun 10, 2024

Updated Apr 28, 2026

Link EUVD-2024-35417

GitHub

No data