Infility Global WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Infility Global WordPress plugin, affecting versions through 2.14.7. This vulnerability allows for arbitrary file download, which could lead to the exposure of sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could result in unauthorized access to any file on the affected website, including sensitive information like login credentials or backup files.

Remediation

Users of the Infility Global WordPress plugin are advised to update to a version later than 2.14.7. For immediate protection, Patchstack offers a virtual patch that blocks attacks targeting this vulnerability.