WooMulti WordPress Plugin Vulnerability

The WooMulti WordPress plugin is a popular file management tool for WordPress websites. It allows users to manage and delete files on the server. However, due to a vulnerability in this plugin, an authenticated user can potentially delete arbitrary files on the server, allowing them to access sensitive data or disrupt the website's functionality.

You're affected if you use WooMulti WordPress. Affected versions: 17

To fix this vulnerability, you can upgrade to WooMulti version 18 or later. You can do this by:

• Updating your WordPress plugin repository URL in the wp-config.php file
• Running the following command in your terminal:

wp update-plugin woo-multi --version=18+

If an immediate fix isn't possible, you can implement the following mitigations:

• Restrict access to the WooMulti plugin by adding a custom capability to the wp-admin role
• Monitor file deletion activity for suspicious patterns

• wpscan.com