CVE-2024-8393 Details
Description
The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Please note that this can also be exploited via CSRF techniques.
A local file inclusion vulnerability has been identified in the Woocommerce Blocks - Woolook plugin for WordPress, affecting all versions through 1.7.0. The vulnerability arises from improper handling of the 'tab' parameter, allowing authenticated attackers with Administrator-level access to include and execute arbitrary files on the server. This exploitation could be used to bypass access controls, access sensitive information, or execute code in cases where files perceived as safe, such as images, can be uploaded and included. Additionally, this vulnerability can be exploited using Cross-Site Request Forgery (CSRF) techniques.
No known patch is available for this vulnerability. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 16, 2025CISA-ADP
Assessed Aug 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Woocommerce Blocks – Woolook | <= 1.7.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 16, 2025 | New CVE Received | [email protected] |