Full Path Disclosure Vulnerability in WP Popups Plugin for WordPress

CVE-2024-6555

Summary

The WP Popups plugin for WordPress suffers from a Full Path Disclosure vulnerability that affects all versions up to and including 2.2.0.1. This issue arises due to the plugin’s use of mobiledetect without appropriate restrictions on file access. As a result, unauthenticated attackers can exploit this vulnerability to reveal the full directory path of the web application. While the information obtained may not pose an immediate threat by itself, it can potentially be leveraged in conjunction with other vulnerabilities to compromise the security of affected websites.

References