Critical · published January 14, 2026
🚨 An unauthenticated POST request could let attackers delete or download ANY file — even your precious `wp-config.php`! 😱 It's like a delivery person who can drop off packages anywhere in your house without checking if they have the right address. The `process_table_bulk_actions()` function is processing file paths without any checks, giving a free pass to malicious requests. This vulnerability is absolutely devastating! An attacker could swiftly erase critical files, rendering your website inoperable or gain access to sensitive configurations. It's not just about a prank; it's about losing control of your WordPress instance!
It's like a delivery person who can drop off packages anywhere in your house without checking if they have the right address. The `process_table_bulk_actions()` function is processing file paths without any checks, giving a free pass to malicious requests. The Path Traversal vulnerability in the Opvius AI for WooCommerce plugin allows unauthenticated users to manipulate file paths through the `wsaw-log[]` POST parameter, bypassing authentication checks, nonce validation, and path validation entirely.
This vulnerability is absolutely devastating! An attacker could swiftly erase critical files, rendering your website inoperable or gain access to sensitive configurations. It's not just about a prank; it's about losing control of your WordPress instance! Immediately update the plugin to version 1.3.1 or later. Implement strict input validation to ensure no unauthorized file paths can be processed, and consider adding authentication checks for affected functions. Don't leave your server exposed! This is fixable! Follow these steps and you'll be back to security hero status in no time! 🛡️