100plugins Open User Map Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the 100plugins Open User Map WordPress plugin, affecting versions through 1.4.16. This vulnerability allows arbitrary file download, enabling malicious actors to download any file from the affected website, including sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized downloading of files from the affected website, potentially including sensitive information like login credentials or backup files.

Remediation

Users of the 100plugins Open User Map WordPress plugin should update to version 1.4.17 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.