CVE-2024-12861

The CVE CVE-2024-12861 affects the WordPress plugin "W2S – Migrate WooCommerce to Shopify". It allows an authenticated user with Subscriber-level access or higher to read arbitrary files on the server via the viw2s_view_log AJAX action, for all versions up to and including 1.2.1. This exposes pot...

CVE-2024-12861: External Control of File Name or Path

The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2sviewlog' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of...

PT-2025-1972 · WordPress · W2S – Migrate Woocommerce To Shopify

Name of the Vulnerable Software and Affected Versions: W2S – Migrate WooCommerce to Shopify plugin for WordPress versions up to, and including, 1.2.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to read the contents of arbitrary files on the server...