CVE-2022-1953: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-1953 affects the Product Configurator for WooCommerce plugin versions below 1.2.32. It was discovered and publicly disclosed on June 6, 2022. This security flaw is classified as an unauthenticated arbitrary file deletion vulnerability, which received a CVSS score of 7.5 (high) (WPScan).

The vulnerability exists in an AJAX action that is accessible to unauthenticated users. The issue stems from user input being used in a file path and passed directly to the unlink() function without proper validation. This vulnerability is classified as a Path Traversal (CWE-22) and falls under the OWASP Top 10 category A1: Injection (WPScan).

When exploited, this vulnerability allows unauthenticated attackers to delete arbitrary files on the WordPress host system, provided the web server user has the necessary permissions to access those files. This could lead to site disruption or potential security breaches depending on which files are targeted (WPScan).

The vulnerability is relatively straightforward to exploit using an HTTP POST request to the WordPress admin-ajax.php endpoint. An attacker can specify a file path using directory traversal sequences (../../) to target files outside the intended directory structure (WPScan).

The vulnerability has been fixed in version 1.2.32 of the Product Configurator for WooCommerce plugin. Users are strongly advised to update to this version or later to protect their installations (WPScan).