WordPress WP01 Plugin Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the WordPress WP01 plugin, specifically in versions through 2.6.2. This vulnerability allows for arbitrary file download, enabling attackers to download any file from the affected website, including sensitive files such as those containing login credentials or backups.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the website, potentially including login credentials or backup files.

Remediation

Users of the WordPress WP01 plugin are advised to update to version 2.6.2 or later. For those unable to update immediately, Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability.