WordPress Music Sheet Viewer Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the WordPress Music Sheet Viewer plugin, specifically in versions through 4.1. This vulnerability allows for arbitrary file download, enabling malicious actors to download any file from the affected website, including sensitive files such as those containing login credentials or backups.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the affected website, with potential exposure of login credentials or other confidential information.

Remediation

Users are advised to update to a version of the WordPress Music Sheet Viewer plugin that is later than 4.1. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability.