Stylemix uListing WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the Stylemix uListing WordPress plugin, specifically in versions through 2.2.0. This vulnerability allows for arbitrary file download, enabling attackers to download any file from the affected website, including sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized downloading of files from the affected website, potentially including sensitive information like login credentials or backup files.

Remediation

Users are advised to update to a version of the uListing WordPress plugin that is later than 2.2.0. For those using Patchstack, a mitigation rule has been issued to block attacks targeting this vulnerability.