Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

mediumseverity

5.3CVSS score

0.9%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.

Impact

Unauthenticated attackers can access PHP configuration information including server details, installed extensions, and environment variables, which can aid in planning further attacks.

Fix

Update Google for WooCommerce plugin to version 2.8.7 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/google-listings-and-ads/vendor/googleads/google-ads-php/scripts/print_php_information.php
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2024-10486 -u <target>

The full check

id: CVE-2024-10486

info:
  name: Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
  author: popcorn94
  severity: medium
  description: |
    The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
  impact: |
    Unauthenticated attackers can access PHP configuration information including server details, installed extensions, and environment variables, which can aid in planning further attacks.
  remediation: |
    Update Google for WooCommerce plugin to version 2.8.7 or later.
  reference:
    - https://plugins.trac.wordpress.org/browser/google-listings-and-ads/tags/2.8.6/vendor/googleads/google-ads-php/scripts/print_php_information.php
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-listings-and-ads/google-for-woocommerce-286-information-disclosure-via-publicly-accessible-php-info-file
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-10486
    cwe-id: CWE-862
    epss-score: 0.00944
    epss-percentile: 0.61368
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/google-listings-and-ads/"
  tags: cve,cve2024,wp,wordpress,wp-plugin,google-listings-and-ads,info-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/google-listings-and-ads/vendor/googleads/google-ads-php/scripts/print_php_information.php"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from