CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Error Log Viewer By WP Guru versions 1.0.1.3 and earlier contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft requests to access sensitive files outside the intended directory, such as configuration files or system logs. No user interaction is required. Update to a version newer than 1.0.1.3.
What an attacker can do
Read arbitrary files from the server, including configuration files and sensitive data.
Potential impact on your site
Attackers can access sensitive files like wp-config.php, database credentials, and system logs without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
