3D Product configurator for WooCommerce, CVE-2022-1953

CVE, Research URL: CVE-2022-1953
Home page URL: Security reports for 3D Product configurator for WooCommerce
Application: 3D Product configurator for WooCommerce
Published on: Jun 27, 2022
Research Description: The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first
Affected versions: Min -, max 1.0.6.
Status: vulnerable