CVE-2024-12861

creationtimestamp| type| source ---|---|--- 2025-01-30 14:16:52+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgxodxbeh72e 2025-01-30 14:32:02+00:00| seen| https://infosec.exchange/users/cve/statuses/113917789478720881 2025-01-30 16:46:42+00:00| seen|...

CVE-2024-12861 W2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2sviewlog' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of...

CVE-2024-12861

The CVE CVE-2024-12861 affects the WordPress plugin "W2S – Migrate WooCommerce to Shopify". It allows an authenticated user with Subscriber-level access or higher to read arbitrary files on the server via the viw2s_view_log AJAX action, for all versions up to and including 1.2.1. This exposes pot...