WordPress File Upload, CVE-2024-12719

CVE, Research URL: CVE-2024-12719
Home page URL: Security reports for WordPress File Upload
Application: WordPress File Upload
Published on: Jan 07, 2025
Research Description: The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed.
Affected versions: Min -, max 4.25.0.
Status: vulnerable