Spy0X7

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site — not that the requested file path belongs to that product's configured downloads — making exploitation viable on any WooCommerce site with at least one such product.

**Name of the Vulnerable Software and Affected Versions** CM Map Locations – Visualize and share your locations in a few clicks versions prior to 2.1.9 **Description** Insufficient file type validation in the upload handler allows authenticated attackers with subscriber-level access and above to perform a limited arbitrary file upload. The issue occurs within the `uploadMedia()` function, which uses incomplete extension filtering and fails to perform MIME-type checks or verify upload capabilities before calling `move uploaded file()`. This can lead to remote code execution if executable files are uploaded. The required nonce is exposed to logged-in subscribers through the `CMLOC Editor Images` JavaScript object on the front-end location editor page. **Recommendations** Update to a version newer than 2.1.8. As a temporary mitigation, restrict access to the front-end location editor page for users with subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** RapiSafe – Secure Multi File Upload for Contact Form 7 versions prior to 1.0.5 **Description** Insufficient file path validation in the `handleAjaxRemoveUpload()` function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as `wp-config.php`, are deleted. The required nonce is exposed in public-facing JavaScript as `RSMFCF7Vars.nonce` on any Contact Form 7 page that renders a RapiSafe upload field, allowing any visitor to obtain it. The attack involves the `rsmfcf7 session` and `file name` parameters. **Recommendations** Update RapiSafe – Secure Multi File Upload for Contact Form 7 to version 1.0.5 or later. As a temporary workaround, restrict access to the `handleAjaxRemoveUpload()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Demi – One Click Demo Import, WP Backup & Site Migration versions prior to 0.0.8 **Description** An unauthenticated attacker can recursively delete arbitrary directories on the server. This occurs because the plugin stores its HMAC signing key and per-step restore token as dotfiles in a publicly accessible subdirectory of the WordPress uploads folder without proper protection. The `demi restore step` AJAX handler allows unauthenticated callers to use the exposed signing key as an alternative to standard capability and nonce checks. By retrieving this key, an attacker can forge a signed state envelope to trigger the `CleanDir::execute()` function using a caller-supplied absolute path that lacks allow-list or path-canonicalization checks. **Recommendations** Update to a version newer than 0.0.7. As a temporary mitigation, restrict public access to the plugin's subdirectory within the WordPress uploads folder to prevent the retrieval of the HMAC signing key.