CVE-2024-39651 in WooCommerce PDF Vouchers Plugin
Summary
by MITRE • 08/13/2024
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/28/2026
This vulnerability represents a critical path traversal flaw in the WPWeb WooCommerce PDF Vouchers plugin that enables unauthorized file manipulation through improper pathname limitation. The vulnerability stems from inadequate input validation and sanitization of user-supplied data that is used to construct file paths during PDF voucher generation processes. Attackers can exploit this weakness by crafting malicious input that bypasses directory restrictions, allowing them to access, modify, or delete files outside the intended restricted directories. The vulnerability specifically impacts versions prior to 4.9.5 of the WooCommerce PDF Vouchers plugin, indicating that the developers identified and patched this security gap in their subsequent releases.
The technical implementation of this path traversal vulnerability occurs when the plugin processes user inputs without proper validation of directory traversal sequences such as ../ or ..\ that could allow attackers to navigate outside the designated working directory. This flaw directly maps to CWE-22, which defines improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability allows malicious actors to manipulate the file system by injecting sequences that cause the application to access files outside the intended directory structure, potentially leading to unauthorized data access or modification.
From an operational perspective, this vulnerability presents significant risks to e-commerce platforms utilizing the affected WooCommerce plugin. An attacker could exploit this weakness to access sensitive customer data, modify voucher templates, or even gain access to server files containing database credentials or other sensitive information. The impact extends beyond simple file manipulation as it could enable attackers to escalate privileges, install backdoors, or cause denial of service conditions by corrupting critical application files. The vulnerability affects the integrity and confidentiality of the entire WooCommerce ecosystem where the plugin is deployed, potentially compromising thousands of customer records and business operations.
The recommended mitigation strategy involves immediately upgrading to version 4.9.5 or later of the WPWeb WooCommerce PDF Vouchers plugin where the path traversal vulnerability has been addressed through proper input validation and sanitization measures. Organizations should also implement additional security controls such as restricting file permissions, implementing web application firewalls, and conducting regular security audits of their WooCommerce installations. According to ATT&CK framework, this vulnerability aligns with T1059.007 for command and scripting interpreter and T1566 for credential access, as attackers could potentially leverage this weakness to gain unauthorized access to system resources and escalate their privileges within the affected environment.