Executive brief
The Woosa – Marktplaats for WooCommerce plugin for WordPress, which integrates WooCommerce stores with the Marktplaats marketplace, contains a security flaw that allows administrators to read sensitive files on the server. By exploiting this vulnerability, an attacker with high-level access could view critical configuration files, potentially exposing database credentials and other private site data. This could lead to a broader compromise of the website's infrastructure.
Technical details
The vulnerability is a Path Traversal (CWE-22) located in the render_logs_ui() function of the Woosa – Marktplaats for WooCommerce plugin. The function accepts a base64-encoded file name via the 'log_file' GET parameter and concatenates it with the plugin's log directory path without proper sanitization or validation. An authenticated attacker with Administrator-level privileges can use this to traverse outside the intended directory and read arbitrary files on the server, such as wp-config.php. The issue is addressed in version 2.0.5.
Affected products
- Woosa (teamwsa) Woosa – Marktplaats for WooCommerce up to and including 2.0.4
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
References
- https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.4/vendor/woosa/logger/class-module-logger-hook-settings.php
- https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.4/vendor/woosa/logger/class-module-logger-hook-settings.php
- https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.5/vendor/woosa/logger/class-module-logger-hook-settings.php
- https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/tags/2.0.5/vendor/woosa/logger/class-module-logger-hook-settings.php
- https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/trunk/vendor/woosa/logger/class-module-logger-hook-settings.php
- https://plugins.trac.wordpress.org/browser/integration-marktplaats-for-woocommerce/trunk/vendor/woosa/logger/class-module-logger-hook-settings.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3576889%40integration-marktplaats-for-woocommerce&new=3576889%40integration-marktplaats-for-woocommerce&sfp_email=&sfph_mail=