Unauthorized Access Vulnerability in Sandbox Plugin for WordPress

CVE-2024-13367

What is CVE-2024-13367?

The Sandbox plugin for WordPress is susceptible to unauthorized access due to a flaw in the capability check for the export_download action. This vulnerability exists in all versions up to and including 0.4, allowing authenticated attackers with Subscriber-level access or above to download a complete copy of a sandbox environment. This breach can potentially expose sensitive information, including the wp-config.php file, posing significant security risks.

References