Path Traversal Vulnerability in WordPress File Upload Plugin

CVE-2024-9939

Summary

The WordPress File Upload plugin is susceptible to a Path Traversal vulnerability due to improper validation in the 'wfu_file_downloader.php' script. This issue affects all versions up to and including 4.24.13, allowing unauthenticated attackers to read sensitive files located outside the intended directory. The vulnerability highlights the importance of maintaining updated plugins and implementing necessary security measures to safeguard WordPress sites from unauthorized file access.

References