What the vulnerability does
01Description
A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
Explanation of Vulnerability in Simple Terms
02Summary
The secure-files plugin contains a path traversal vulnerability that allows an attacker with low privileges to read or modify files outside the intended directory. The vulnerability requires adjacent network access and low-level authentication. An attacker can exploit this to access sensitive files on the site or alter content, depending on file permissions.
What an attacker can do
03Attacker Capabilities
Read or modify files outside the plugin's intended directory on the server.
Potential impact on your site
04Site Impact
Sensitive files may be exposed or altered; site integrity and confidentiality at risk depending on file permissions.
Conditions required to exploit
05Prerequisites
Attacker must have low-level user account access and be on the same local network segment.
Key dates
06Disclosure timeline
October 29, 2023
CVE published
August 8, 2024
Record updated
