Full Path Disclosure Vulnerability in WooODT Lite Plugin for WordPress

CVE-2024-13540

Summary

The WooODT Lite plugin for WordPress is susceptible to a Full Path Disclosure vulnerability due to the publicly accessible /inc/bycwooodt_get_all_orders.php file. This flaw allows unauthenticated attackers to view detailed error messages revealing the full path of the web application. While the disclosed information may not seem valuable by itself, it can serve as a stepping stone for more severe attacks if combined with other vulnerabilities. Users of versions up to and including 2.5.1 are urged to take immediate action to secure their installations.

References