CVE-2024-13922

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-139236.5The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and CVE-2024-139249.1The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and includin CVE-2024-139257.5The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attac CVE-2024-139267.5The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number o CVE-2024-139287.2SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentia CVE-2024-139297.2Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue CVE-2024-13935.4The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content CVE-2024-139304.9An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator cred CVE-2024-139317.2Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. Th CVE-2024-139338.8The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versio CVE-2024-139397.5String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret CVE-2024-13947.5A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using