AForms Eats WordPress Plugin Full Path Disclosure Vulnerability

A full path disclosure vulnerability exists in the AForms Eats plugin for WordPress, affecting all versions through 1.3.1. The issue arises because the 'vendor/aura/payload-interface/phpunit.php' file is publicly accessible and reveals error messages. This vulnerability allows unauthenticated attackers to obtain the full path of the web application, potentially facilitating further attacks. However, the disclosed information is not harmful on its own and would require the presence of another vulnerability to cause damage to the affected website.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of the full server path, which may assist in launching additional attacks against the website.

Remediation

Users can update to version 1.3.2 or a newer patched version to address this vulnerability.