CVE-2017-17058: Automattic Woocommerce

High severity, CVSS 7.5. EPSS: 23.7% chance of exploitation in the next 30 days.

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code

Affected products

• Automattic Woocommerce: up to and including 3.2.6

Published 2017-11-29. Last modified 2026-06-17.