vulnerability

WordPress Plugin: best-woocommerce-feed: CVE-2023-52144: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:M/C:N/I:P/A:N)

Published

Dec 28, 2023

Added

May 15, 2025

Modified

May 5, 2026

Description

The Product Feed Manager – WooCommerce to Google Shopping, Social Catalogs, and 170+ Popular Marketplaces plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.3.15 via the vulnerable parameter 'logKey'. This makes it possible for authenticated attackers, with administrator-level access and above, to include arbitrary files on the server, which can lead to remote code execution.

Solution

best-woocommerce-feed-plugin-cve-2023-52144

References

https://www.cve.org/CVERecord?id=CVE-2023-52144
https://www.wordfence.com/threat-intel/vulnerabilities/id/7a20b65a-6d3a-41fc-80c5-94cce0459a6b?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-56817
CVE-2023-52144
https://attackerkb.com/topics/CVE-2023-52144
CWE-22
EUVD-EUVD-2023-56817

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report