CVE-2023-0080 Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI
Contributors can exploit a shortcode attribute to read arbitrary files or execute code via path traversal in the Customer Reviews for WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0080?
CVE-2023-0080 is a high-severity path traversal vulnerability in Unknown Customer Reviews for WooCommerce, published on 13 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Which versions are affected by CVE-2023-0080?
It affects 1 product.
Products include Cusrev Customer Reviews for Woocommerce.
How do I fix CVE-2023-0080?
No fix has been published for CVE-2023-0080 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-0080 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0080 exists.
Other vulnerabilities in Unknown Customer Reviews for WooCommerce
- CVE-2023-6979 Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload
- CVE-2024-3731 Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'
- CVE-2023-0079 Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS
- CVE-2024-1044 Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review
- CVE-2022-40194 WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability
Sources
Also known as GHSA-695g-cv7c-9p7x.