Whatm

**Name of the Vulnerable Software and Affected Versions** PPOM – Product Addons & Custom Fields for WooCommerce versions prior to 34.0.11 **Description** Insufficient file path validation in the `rename files()` function allows unauthenticated attackers to delete arbitrary files on the server. This action can lead to remote code execution if critical files, such as `wp-config.php`, are deleted. Additionally, the process moves the targeted file into the publicly accessible `wp-content/uploads/ppom files/confirmed/` directory, enabling arbitrary file read for any web-readable file on the server. **Recommendations** Update PPOM – Product Addons & Custom Fields for WooCommerce to version 34.0.11 or later. As a temporary mitigation, restrict access to the `rename files()` function.