James Laforge Infocob CRM Forms Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the James Laforge Infocob CRM Forms plugin, affecting versions through 2.4.0. This vulnerability allows for arbitrary file download by improperly restricting file paths, potentially leading to the exposure of sensitive files such as login credentials or backup data.

Impact

Exploitation of this vulnerability could result in unauthorized downloading of files from the affected website, including sensitive information like login credentials or backup files.

Remediation

Users of the Infocob CRM Forms WordPress plugin should update to version 2.4.1 or later. Patchstack users can enable auto-updates for vulnerable plugins.