WordPress File Upload Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in the WordPress File Upload plugin, affecting all versions through 4.24.13. The issue resides in the wfu_file_downloader.php file, where unauthenticated attackers can exploit the vulnerability to read files outside the intended directory.

Impact

Exploitation of this vulnerability allows for arbitrary file read, which could lead to exposure of sensitive information on the server.

Reproduction

The vulnerability can be reproduced by sending a request to the WordPress site with the 'file' parameter set to a value that includes path traversal sequences. This can be done through a regular HTTP request, such as via curl or a web browser, depending on the target file's location and the server's file system structure.

Remediation

Users are advised to update the WordPress File Upload plugin to version 4.24.14 or later.