CVE-2024-50509

🗓️ 30 Oct 2024 07:41:04Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

Improper limitation of directory pathname in Woocommerce Product Desig

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2024-50509	16 Dec 202419:17	–	githubexploit
BDU FSTEC	The vulnerability of the Woocommerce Product Design plugin of the WordPress content management system arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain access to read, modify, or delete data.	13 Jan 202500:00	–	bdu_fstec
Circl	CVE-2024-50509	30 Oct 202410:00	–	circl
CNNVD	WordPress plugin Woocommerce Product Design 路径遍历漏洞	30 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-50509 WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability	30 Oct 202407:41	–	cvelist
NVD	CVE-2024-50509	30 Oct 202408:15	–	nvd
Patchstack	WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability	28 Oct 202410:29	–	patchstack
Patchstack	WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Deletion	28 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-10047 · WordPress · Woocommerce Product Design	24 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-50509	5 Feb 202506:51	–	redhatcve

Vulners

Node

chetan_khandla woocommerce_product_designRange≤1.0.0wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "woo-product-design",
    "product": "Woocommerce Product Design",
    "vendor": "Chetan Khandla",
    "versions": [
      {
        "lessThanOrEqual": "1.0.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/woo-product-design/vulnerability/wordpress-woocommerce-product-design-plugin-1-0-0-arbitrary-file-deletion-vulnerability

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Unauthenticated arbitrary file deletion via path traversal in Woocommerce Product Design (<=1.0.0) using admin-ajax.php with file[path] payload.	CWE-22
file[path]	request body	wp-admin/admin-ajax.php	Unauthenticated arbitrary file deletion via path traversal in Woocommerce Product Design (<=1.0.0) using admin-ajax.php with file[path] payload.	CWE-22

17 Jun 2026 08:04Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.6

EPSS0.01296

SSVC

CWE-22