Unauthorized Data Access in DesignThemes Core Features Plugin for WordPress

CVE-2024-13471

What is CVE-2024-13471?

The DesignThemes Core Features plugin for WordPress has a vulnerability that permits unauthorized access to sensitive data caused by a missing capability check in the dt_process_imported_file function. This flaw affects all versions up to and including 4.7, allowing unauthenticated attackers to potentially read arbitrary files on the underlying operating system, thereby exposing sensitive information and leading to significant security risks.

References