WP Table Manager Missing Authorization Vulnerability Allowing Directory Traversal and File Name Disclosure

A vulnerability exists in the WP Table Manager plugin for WordPress, in all versions through 4.1.3. The issue arises from a missing capability check on the 'wptm_getFolders' AJAX action, which allows authenticated attackers with Subscriber-level access and above to access and read arbitrary file names and directory information.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of file names and directory structures on the server.

Remediation

Users are advised to update the WP Table Manager plugin to version 4.1.4 or a newer patched version.