CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Spectra Gutenberg Blocks versions up to 2.12.6 contain a path traversal vulnerability that allows authenticated users to read files outside the intended directory. An attacker with low-level site access can craft requests to access sensitive files on the server. This affects confidentiality but not integrity or availability.
What an attacker can do
Read files outside the intended directory on the server.
Potential impact on your site
Users with contributor or subscriber roles could access sensitive files like configuration or database backups.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
