Directory Traversal Vulnerability in WordPress File Upload Plugin

CVE-2024-5852

Summary

The WordPress File Upload plugin is susceptible to a Directory Traversal vulnerability that can be exploited by authenticated users with Contributor-level access or higher. By manipulating the 'uploadpath' parameter in the wordpress_file_upload shortcode, attackers can upload files to unauthorized locations on the web server. This could lead to potential security breaches, including unauthorized data access or server compromise, emphasizing the need for immediate remediation.

References