CVE-2024-50509: WooCommerce Product Design Path Traversal

CVE-2024-50509 Overview

CVE-2024-50509 is a path traversal vulnerability in the Chetan Khandla woo-product-design WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.0. Attackers can exploit improper limitation of a pathname to a restricted directory [CWE-22] to delete arbitrary files on the underlying server. The vulnerability is exploitable remotely over the network without authentication or user interaction. Deletion of critical files such as wp-config.php can force WordPress into a setup state, enabling site takeover. The issue was published to the National Vulnerability Database (NVD) on October 30, 2024.

Critical Impact
Unauthenticated attackers can delete arbitrary files on the WordPress host, leading to availability loss and potential site takeover through removal of configuration files.

Affected Products

Chetan Khandla WooCommerce Product Design plugin (woo-product-design)
All versions from n/a through 1.0.0 (inclusive)
WordPress installations running the affected plugin with WooCommerce

Discovery Timeline

2024-10-30 - CVE-2024-50509 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-50509

Vulnerability Analysis

The woo-product-design plugin exposes a file-handling endpoint that accepts a user-supplied filename and passes it to a deletion routine without normalizing or constraining the path. An attacker can supply traversal sequences such as ../../ to escape the intended upload directory and target arbitrary files writable by the web server user.

The CVSS vector indicates network-reachable exploitation without privileges or user interaction, with scope change and high availability impact. Confidentiality and integrity are unaffected directly, but deleting wp-config.php, .htaccess, or theme files cascades into broader integrity and confidentiality consequences during subsequent reinstallation flows. The EPSS probability is approximately 1.3%, placing this CVE in the 66th percentile of exploit likelihood.

Root Cause

The root cause is missing input validation on a path parameter consumed by a file deletion handler exposed through WordPress AJAX or a REST route. The plugin neither canonicalizes the requested path with realpath() nor enforces that the resolved location stays within the plugin's designated upload directory.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint, supplying a filename parameter containing directory traversal sequences. The handler resolves the path relative to the plugin directory and invokes unlink() on the resulting target. Deleting wp-config.php triggers WordPress to display the installation wizard on the next page load, allowing the attacker to reconfigure the site against a database they control.

No public proof-of-concept code has been verified for this CVE. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-50509

Indicators of Compromise

HTTP requests to woo-product-design plugin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in filename parameters.
Unexpected disappearance of wp-config.php, .htaccess, or plugin and theme PHP files on a WordPress host.
WordPress site unexpectedly redirecting visitors to /wp-admin/setup-config.php or the installation wizard.
Web server access logs showing POST requests to admin-ajax.php referencing the plugin with abnormal file or path parameters.

Detection Strategies

Inspect HTTP request bodies and query strings for path traversal patterns targeting plugin AJAX actions.
Monitor file integrity on the WordPress document root for unauthorized deletions of core files.
Correlate unlink syscalls executed by the PHP-FPM or web server process with requests to the affected plugin.

Monitoring Recommendations

Enable WordPress audit logging and forward events to a central SIEM for retention and correlation.
Alert on any process spawned by the web server user that modifies or deletes files outside wp-content/uploads.
Track 5xx response spikes and sudden traffic to setup or installation URLs as indicators of post-exploitation state.

How to Mitigate CVE-2024-50509

Immediate Actions Required

Deactivate and remove the woo-product-design plugin from all WordPress installations until a fixed release is published.
Audit the WordPress filesystem for missing or modified core files and restore from known-good backups.
Rotate database credentials and WordPress secret keys if wp-config.php may have been exposed or deleted.
Block requests containing path traversal sequences at the web application firewall (WAF) layer.

Patch Information

No vendor patch is referenced in the available advisory data. The vulnerability affects all versions through 1.0.0. Monitor the Patchstack advisory and the WordPress plugin repository for an official fix.

Workarounds

Remove the plugin entirely if business operations permit, as no patched version is confirmed.
Apply WAF rules that reject any request to admin-ajax.php or plugin endpoints containing .., %2e%2e, or absolute path indicators.
Restrict filesystem permissions so the web server user cannot delete files outside wp-content/uploads.
Place wp-config.php one directory above the WordPress root where supported, reducing the impact of traversal-based deletion.

bash

# Example ModSecurity rule to block path traversal in plugin requests
SecRule REQUEST_URI "@contains woo-product-design" \
  "chain,deny,status:403,id:1005009,msg:'Blocked path traversal attempt in woo-product-design'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"