Unauthorized Data Access Vulnerability in WordPress File Upload Plugin

CVE-2024-12719

What is CVE-2024-12719?

The WordPress File Upload plugin is susceptible to unauthorized data exposure due to a missing capability check in the 'wfu_ajax_action_read_subfolders' function. This vulnerability enables authenticated users with Subscriber-level access or higher to execute limited path traversal attacks, allowing them to list directory contents and navigate through subdirectories in WordPress. However, it should be noted that direct file viewing remains unaffected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References