LikeCoin Web3Press Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the LikeCoin Web3Press WordPress plugin, specifically in versions through 3.2.0. This vulnerability allows for arbitrary file downloads, potentially enabling attackers to access sensitive files such as login credentials or backup data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to any file on the affected website, including sensitive information like login credentials or backup files.

Remediation

Users of the LikeCoin Web3Press WordPress plugin should update to version 3.3.0 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.