CVE-2023-35881
WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.
| CWE | CWE-22 |
| Vendor | woocommerce |
| Product | woocommerce one page checkout |
| Published | May 17, 2024 |
| Last Updated | Apr 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for woocommerce woocommerce one page checkout
Be the first to know when new high vulnerabilities affecting woocommerce woocommerce one page checkout are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected Versions
WooCommerce / WooCommerce One Page Checkout
n/a ≤ 2.3.0
References
Credits
Rafie Muhammad (Patchstack)