Path Traversal Vulnerability in YARPP Allows PHP Local File Inclusion
CVE-2022-45374

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
Yarpp
Vendor
CVE Published:
17 May 2024

Summary

The YARPP (Yet Another Related Posts Plugin) for WordPress is susceptible to a Path Traversal vulnerability that allows an attacker to exploit improper limitations on pathname input. This vulnerability can lead to PHP Local File Inclusion, posing a significant risk of unauthorized access to sensitive files on the server. It is essential for WordPress administrators using YARPP from inexistent to version 5.30.4 to assess their security posture and implement necessary updates or mitigations.

Affected Version(s)

YARPP <= 5.30.4

References

https://patchstack.com/database/vulnerability/yet-another...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.