Path Traversal Vulnerability in InfiniteWP Client Plugin for WordPress

CVE-2024-10585

Summary

The InfiniteWP Client plugin for WordPress contains a Path Traversal vulnerability that affects all versions up to and including 1.13.0. This flaw arises from improper validation of the 'historyID' parameter in the ~/debug-chart/index.php file, allowing unauthenticated attackers to access sensitive .txt files located outside the intended directory. If exploited, this could lead to unauthorized disclosure of potentially sensitive information, highlighting the importance of updating to the latest version to safeguard against such attacks.

References