CVE-2014-9461

CVE-2014-9461 affects the WordPress plugin Cart66 Lite (models/Cart66.php). The vulnerability is a directory traversal in the member_download action via “..” exposed to wp-admin/admin-ajax.php, allowing authenticated remote users to read arbitrary files. Affected version: Cart66 Lite prior to 1.5...