BitFire Security WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the BitFire Security WordPress plugin, specifically in versions through 4.5. The issue arises from the plugin's bitfire_* directory, which is created automatically and lacks access restrictions, allowing unauthenticated attackers to retrieve sensitive files such as config.ini and debug.log.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including configuration details and debug logs, which may contain personal data or other critical information.

Remediation

Users are advised to update the BitFire Security WordPress plugin to version 4.6 or later.