RSFirewall! WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in the RSFirewall! plugin for WordPress, affecting all versions through 1.1.42. The issue arises in the get_local_filename() function, where improper validation allows authenticated attackers with Administrator-level access to read arbitrary files on the server. This could lead to the exposure of sensitive information.

Impact

Exploitation of this vulnerability allows for authenticated users with Admin privileges to read sensitive files from the server.

Remediation

Users can update to version 1.1.43 or a newer patched version to address this vulnerability.