CVE-2024-10585: InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10585?
CVE-2024-10585 has been classified as a high-severity vulnerability due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2024-10585?
To fix CVE-2024-10585, it is recommended to update the InfiniteWP Client plugin to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-10585?
CVE-2024-10585 affects all versions of the InfiniteWP Client plugin for WordPress up to and including version 1.13.0.
What type of vulnerability is CVE-2024-10585?
CVE-2024-10585 is a Path Traversal vulnerability that allows attackers to read files outside the intended directory.
Can authenticated users exploit CVE-2024-10585?
CVE-2024-10585 can be exploited by unauthenticated users, making it particularly concerning for the security of systems using the affected plugin.