WordPress 简数采集器 Plugin Arbitrary File Read Vulnerability for Authenticated Administrators

A vulnerability allowing arbitrary file read has been identified in the 简数采集器 plugin for WordPress, affecting all versions through 2.6.3. This vulnerability arises from the __kds_flag functionality, which imports featured images. It enables authenticated attackers with Administrator-level access or higher to read the contents of arbitrary files on the server, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information stored in files on the server.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.