WordPress File Upload Plugin Missing Capability Check Vulnerability Allowing Limited Path Traversal

A vulnerability exists in the WordPress File Upload plugin, specifically in versions through 4.24.15. The issue arises from a lack of proper capability checks in the 'wfu_ajax_action_read_subfolders' function. This flaw enables authenticated attackers with Subscriber-level access or higher to execute limited path traversal, allowing them to view directories and subdirectories within WordPress. However, this vulnerability does not permit access to files themselves.

Impact

Exploitation of this vulnerability could lead to unauthorized directory traversal, allowing attackers to view directory structures and subdirectory contents within WordPress.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'wfu_ajax_action_read_subfolders' function without the necessary capability checks. This can be done by exploiting the missing authorization to access subfolder structures defined in WordPress File Upload shortcodes.

Remediation

Users are advised to update the WordPress File Upload plugin to version 4.25.0 or later.