What’s Vulnerable › Vulnerabilities

CVE-2017-17058

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 23.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-11-29 · updated 2026-06-17
• Weakness: CWE-22

Description

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code

Affected products

• Automattic Woocommerce: through 3.2.6

References

• https://github.com/woocommerce/woocommerce/issues/17964
• https://www.exploit-db.com/exploits/43196/
• https://www.exploit-db.com/ghdb/4613/
• https://github.com/woocommerce/woocommerce/issues/17964
• https://www.exploit-db.com/exploits/43196/
• https://www.exploit-db.com/ghdb/4613/

Get alerted when CVE-2017-17058 or the next vulnerability affects your stack