CVE-2024-6550: Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure
The Gravity Forms: Multiple Form Instances plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.1. This is due to the plugin leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/gravity-forms-multiple-form-instancesto a version that resolves this vulnerability.Fixed in 1.1.1 - Configuration
Ensure any test files left by the plugin do not run with PHP display_errors enabled, to prevent unauthenticated full path disclosure (the issue is caused by the plugin leaving test files with display_errors on in versions up to and including 1.1.1).
Gravity Forms: Multiple Form Instances plugin for WordPress display_errors = off
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6550?
CVE-2024-6550 is considered a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2024-6550?
To fix CVE-2024-6550, update the Gravity Forms: Multiple Form Instances plugin to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-6550?
All users of the Gravity Forms: Multiple Form Instances plugin for WordPress up to and including version 1.1.1 are affected by CVE-2024-6550.
What type of vulnerability is CVE-2024-6550?
CVE-2024-6550 is a Full Path Disclosure vulnerability that allows attackers to potentially retrieve sensitive information.
Is authentication required to exploit CVE-2024-6550?
No, CVE-2024-6550 can be exploited by unauthenticated attackers, making it a significant security concern.