Description
Wordpress 插件 kiwiz 是一款用于生成格式为 PDF 的认证发票和收据的插件。Wordpress 插件 kiwiz <= 2.1.3 版本存在文件路径验证缺失漏洞，未经授权的攻击者可以通过该漏洞读取或下载任意文件，甚至可能导致 PHAR 反序列化攻击（假设攻击者能够上传文件到服务器）。
Wordpress Plugins Kiwiz /wp-content/plugins/woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz/entrypoint/concat-pdf.php 文件读取漏洞（CVE-2023-2180）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://wpscan.com/vulnerability/4d3b90d8-8a6d-4b72-8bc7-21f861259a1b/
https://nvd.nist.gov/vuln/detail/CVE-2023-2180
https://github.com/advisories/GHSA-whq3-3cvv-frc4
https://hackhalt.com/threat/cve-2023-2180/
https://patchstack.com/database/wordpress/plugin/woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz/vulnerability/wordpress-kiwiz-invoices-certification-pdf-system-plugin-2-1-3-unauthenticated-arbitrary-file-download-vulnerability
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz/kiwiz-certification-de-facturation-woocommerce-213-unauthenticated-arbitrary-file-download
https://www.cve.org/CVERecord?id=CVE-2023-2180
https://cve.imfht.com/detail/CVE-2023-2180
https://www.ddpoc.com/DVB-2023-4437.html