Full Path Disclosure Vulnerability in Actionwear Products Sync for WordPress

CVE-2024-13535

What is CVE-2024-13535?

The Actionwear Products Sync plugin for WordPress is susceptible to a Full Path Disclosure vulnerability across all versions up to 2.3.0. This issue arises from the composer-setup.php file being publicly accessible with 'display_errors' enabled. Consequently, unauthenticated attackers may exploit this vulnerability to reveal the full path of the web application. While the disclosed information alone does not pose an immediate risk, it potentially assists attackers in executing further targeted exploits against affected sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References