Description

WordPress is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input data. Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks. WordPress versions 5.0.x ranging from 5.0 and up to (and including) 5.0.21 are vulnerable.

Remediation

Update to WordPress version 5.0.22 or latest

References

https://www.wordfence.com/blog/2024/06/wordpress-6-5-5-security-release-what-you-need-to-know/

https://wordpress.org/documentation/wordpress-version/version-5-0-22/

Related Vulnerabilities

XWiki Incorrect Authorization Vulnerability (CVE-2024-38369)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Cross-Site Scripting (1.8.9.3)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce CSV Injection (5.5.2)

PHP Other Vulnerability (CVE-2007-1900)

WordPress Plugin Edwiser Bridge-WordPress Moodle LMS Integration Unspecified Vulnerability (2.0.7)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Directory Traversal