CVE-2024-27971-Note

WordPress Premmerce Permalink Manager for WooCommerce Plugin <= 2.3.10 is vulnerable to Local File Inclusion https://patchstack.com/database/vulnerability/woo-permalink-manager/wordpress-premmerce-permalink-manager-for-woocommerce-plugin-2-3-10-local-file-inclusion-vulnerability

1. I diff woo-permalink-manager.2.3.10 and woo-permalink-manager.2.3.11

2. File: src\Admin\Admin.php => function options() call function includeTemplate(vendor\premmerce\wordpress-sdk\src\V2\FileManager\FileManager.php)

3. File: vendor\premmerce\wordpress-sdk\src\V2\FileManager\FileManager.php => function includeTemplate call function locateTemplate

4. File: views\admin\main.php

Build wordpress: docker-compose -f stack.yml up

Note: wordpress install plugin Premmerce Permalink Manager for WooCommerce and WooCommerce

5. I use pearcmd.php write pwn.php

6. Requests pwn.php