Arbitrary File Movement and Reading Vulnerability in WP Delicious Recipe Plugin for Food Bloggers

CVE-2024-7626

Summary

The WP Delicious – Recipe Plugin for Food Bloggers has a vulnerability that stems from insufficient file path validation in the save_edit_profile_details() function. This flaw allows authenticated users with subscriber-level access or higher to manipulate files on the server. Attackers may exploit this vulnerability to move critical files, such as wp-config.php, leading to possible remote code execution. In addition, the vulnerability presents a risk of accessing sensitive files that may contain confidential information, amplifying the security risk for WordPress sites utilizing this plugin.

References