Description

WordPress is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input data. Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks. WordPress versions 5.4.x ranging from 5.4 and up to (and including) 5.4.15 are vulnerable.

Remediation

Update to WordPress version 5.4.16 or latest

References

https://www.wordfence.com/blog/2024/06/wordpress-6-5-5-security-release-what-you-need-to-know/

https://wordpress.org/documentation/wordpress-version/version-5-4-16/

Related Vulnerabilities

WordPress Plugin Import Export WordPress Users Security Bypass (1.3.8)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-6388)

YUI Library Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4940)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23192)

WordPress Plugin Thrive Quiz Builder Security Bypass (2.3.9.3)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Directory Traversal