CVE-2024-13550: ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read
First published: Sat Jan 25 2025(Updated: )
The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ABC Notation plugin for WordPress | <=6.1.3 | |
| Paulrosen Abc Notation WordPress | <=6.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13550?
CVE-2024-13550 has been classified with a high severity level due to its potential to allow unauthorized access to sensitive files.
Who is affected by CVE-2024-13550?
CVE-2024-13550 affects all users of the ABC Notation plugin for WordPress versions up to and including 6.1.3.
How do I fix CVE-2024-13550?
To fix CVE-2024-13550, update the ABC Notation plugin for WordPress to the latest version available that addresses this vulnerability.
What type of attack does CVE-2024-13550 represent?
CVE-2024-13550 represents a Path Traversal vulnerability that can be exploited by authenticated attackers.
What permissions do attackers need to exploit CVE-2024-13550?
Attackers need at least Contributor-level access or higher to exploit CVE-2024-13550.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/source
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/abc notation
- canonical/abc notation plugin for wordpress
- vendor/paulrosen
- canonical/paulrosen abc notation wordpress
- version/paulrosen abc notation wordpress/6.1.3