WordPress Houzez Property Feed Path Traversal Vulnerability Allowing Arbitrary File Download
Vulnerability
A path traversal vulnerability has been identified in the WordPress Houzez Property Feed plugin, versions through 2.5.4. This vulnerability allows for arbitrary file download by improperly restricting file paths, potentially enabling the download of sensitive files such as login credentials or backup files.
Impact
Exploitation of this vulnerability could lead to unauthorized downloading of files from the affected website, including sensitive information like login credentials or backup files.
Remediation
Users of the WordPress Houzez Property Feed plugin are advised to update to version 2.5.5 or later. Patchstack users can enable auto-update for vulnerable plugins.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.