Researchers with Sucuri have identified an object injection vulnerability in the WooCommerce plugin for WordPress websites.
The issue – which Sucuri deemed dangerous and easy to exploit – has been addressed in WooCommerce version 2.3.11, but all lower versions that have the “PayPal Identity Token†option set are at risk of a full site compromise.
“We managed to use a combination of WordPress and WooCommerce components with a known PHP bug (CVE-2013-1643) to download critical files, files like wp-config.php; for those unfamiliar, this file contains the database credentials and WordPress secret keys,†Marc-Alexandre Montpas, vulnerability researcher with Sucuri, wrote in a Wednesday blog post.
Montpas noted that there are several different attack vectors for an attacker to use, depending on what extensions are available.
Article source: http://www.scmagazine.com/bug-identified-in-woocommerce-plugin-for-wordpress-websites/article/420230/