Full Path Disclosure Vulnerability in XCloner Plugin for WordPress

CVE-2024-6559

What is CVE-2024-6559?

The XCloner Plugin for WordPress is susceptible to Full Path Disclosure across all versions up to and including 4.7.3. This vulnerability stems from the use of the sabre library without enforcing restrictions on direct file access. As a result, unauthenticated attackers can potentially expose the full file path of the WordPress application. Although this information alone may not lead to immediate exploitation, it can provide valuable insights that facilitate subsequent attacks, especially if combined with other existing vulnerabilities.

References