Medium severity6.5NVD Advisory· Published Jan 30, 2025· Updated Jun 17, 2026

CVE-2024-12861

Description

The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_view_log' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

Villatheme/W2s
cpe:2.3:a:villatheme:w2s:*:*:*:*:*:wordpress:*:*
Range: <1.3.0
WordPress/Migrate Shopify To Woocommercellm-fuzzy
Range: <=1.2.1
Package: https://wordpress.org/plugins/migrate-shopify-to-woocommerce
villatheme/W2S – Migrate WooCommerce to Shopifyv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/8a8eeae9-572c-420a-be7d-a240c54e96aenvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000