WordPress PluginPass Path Traversal Vulnerability Allowing Arbitrary File Download
Vulnerability
A path traversal vulnerability has been identified in the WordPress PluginPass Plugin, affecting versions through 0.9.10. This vulnerability allows unauthorized manipulation of web input to file system calls, potentially leading to arbitrary file downloads. Exploitation could enable the download of sensitive files, such as those containing login credentials or backup data.
Impact
Exploitation of this vulnerability could result in unauthorized access to arbitrary files on the server, including sensitive information like login credentials or backup files.
Remediation
Users of WordPress PluginPass Plugin should update to the latest version. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.