Ultimate Video Player WordPress Plugin Directory Traversal Vulnerability Allowing Unauthenticated Arbitrary File Download

A directory traversal vulnerability has been identified in the Ultimate Video Player WordPress & WooCommerce Plugin, affecting all versions through 10.0. The issue resides in the content/downloader.php file, where unauthenticated attackers can exploit the vulnerability to read arbitrary files on the server, potentially accessing sensitive information.

Impact

Exploitation of this vulnerability allows for unauthenticated arbitrary file downloads, which could lead to the exposure of sensitive information stored on the server.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.