Error Log Viewer By WP Guru, CVE-2024-12849

CVE, Research URL: CVE-2024-12849
Home page URL: Security reports for Error Log Viewer By WP Guru
Application: Error Log Viewer By WP Guru
Published on: Jan 07, 2025
Research Description: The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected versions: max 1.0.4.
Status: vulnerable