1003 Mortgage Application WordPress Plugin Full Path Disclosure Vulnerability

A full path disclosure vulnerability has been identified in the 1003 Mortgage Application plugin for WordPress, affecting all versions through 1.87. The issue arises because the file '/inc/class/fnm/export.php' is publicly accessible with error logging enabled. This configuration allows unauthenticated attackers to retrieve the full path of the web application, potentially aiding in the exploitation of other vulnerabilities. However, the disclosed information is not harmful on its own and requires the presence of another vulnerability to cause damage to the affected website.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of the full server path, which may assist in further attacks against the website.