Path Traversal Vulnerability in InfiniteWP Client Plugin for WordPress
CVE-2024-10585

5.3MEDIUM

Key Information:

Vendor

Wordpress
Status
InfiniteWP Client
Vendor
CVE Published:
8 January 2025

What is CVE-2024-10585?

The InfiniteWP Client plugin for WordPress contains a Path Traversal vulnerability that affects all versions up to and including 1.13.0. This flaw arises from improper validation of the 'historyID' parameter in the ~/debug-chart/index.php file, allowing unauthenticated attackers to access sensitive .txt files located outside the intended directory. If exploited, this could lead to unauthorized disclosure of potentially sensitive information, highlighting the importance of updating to the latest version to safeguard against such attacks.

Affected Version(s)

InfiniteWP Client * <= 1.13.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/iwp-client/tags/1.13.0/...
https://plugins.trac.wordpress.org/changeset/3202851/iwp-...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Villu Orav
.
CVE-2024-10585 : Path Traversal Vulnerability in InfiniteWP Client Plugin for WordPress