Description

WordPress is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input data. Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks. WordPress versions 5.0.x ranging from 5.0 and up to (and including) 5.0.21 are vulnerable.

Remediation

Update to WordPress version 5.0.22 or latest

References

https://www.wordfence.com/blog/2024/06/wordpress-6-5-5-security-release-what-you-need-to-know/

https://wordpress.org/documentation/wordpress-version/version-5-0-22/

Related Vulnerabilities

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Multiple Cross-Site Scripting Vulnerabilities (1.8.4.2)

Apache HTTP Server Out-of-bounds Read Vulnerability (CVE-2018-1303)

OpenSSL Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2014-3509)

WordPress Plugin FancyFlickr Cross-Site Scripting (1.0)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0018)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Directory Traversal