C9 Blocks WordPress Plugin Full Path Disclosure Vulnerability

A full path disclosure vulnerability exists in the C9 Blocks plugin for WordPress, affecting all versions through 1.7.7. The issue arises because the plugin includes a publicly accessible 'composer-setup.php' file with error display enabled. This configuration allows unauthenticated attackers to retrieve the full path of the web application, potentially facilitating further attacks. While the disclosed information requires the presence of another vulnerability to cause harm, it could still be leveraged in a targeted exploitation scenario.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of the full server path, which may assist in exploiting other vulnerabilities or conducting targeted attacks against the application or server.