ionCube Tester Plus Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the WordPress ionCube Tester Plus plugin, specifically in versions through 1.3. This vulnerability allows for arbitrary file download, enabling attackers to download any file from the affected website, including sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the affected website, potentially including login credentials or backup files.

Remediation

Users are advised to mitigate this vulnerability immediately. Patchstack has issued a mitigation rule to block attacks until an official patch becomes available. For more information on how to apply this mitigation, visit the Patchstack website.