CVE-2024-35634
📋 TL;DR
This path traversal vulnerability in the Woocommerce - Recent Purchases plugin allows attackers to include local PHP files on the server through improper path validation. It affects WordPress sites using this plugin, potentially leading to sensitive information disclosure or code execution. All versions up to 1.0.1 are vulnerable.
💻 Affected Systems
- Wow-Company Woocommerce - Recent Purchases WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, or website defacement.
Likely Case
Local file inclusion allowing reading of sensitive files like configuration files containing database credentials.
If Mitigated
Limited impact if file permissions are properly restricted and web server runs with minimal privileges.
🎯 Exploit Status
Exploitation is straightforward with publicly available details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.2 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/woo-recent-purchases/woocommerce-recent-purchases-plugin-1-0-1-file-inclusion-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Woocommerce - Recent Purchases'. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 1.0.2+ from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the plugin until patched.
wp plugin deactivate woo-recent-purchases
Web application firewall rule
allBlock requests containing path traversal patterns.
Add WAF rule: Deny requests with '../' sequences in URL parameters
🧯 If You Can't Patch
- Remove the plugin entirely if not essential
- Implement strict file permissions and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Woocommerce - Recent Purchases version. If version is 1.0.1 or earlier, you are vulnerable.Check Version:
wp plugin get woo-recent-purchases --field=versionVerify Fix Applied:
Confirm plugin version is 1.0.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' sequences in parameters
- Access to unexpected PHP files via web requests
- Errors from failed file inclusion attempts
Network Indicators:
- Unusual requests to plugin endpoints with path traversal patterns
SIEM Query:
web_access_logs WHERE url CONTAINS '../' AND url CONTAINS 'woo-recent-purchases'