CVE-2024-6554: Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6554?
CVE-2024-6554 has a severity rating that indicates a potential risk of information exposure through Full Path Disclosure.
How do I fix CVE-2024-6554?
To fix CVE-2024-6554, update the Branda plugin to version 3.4.19 or later.
What is Full Path Disclosure in CVE-2024-6554?
Full Path Disclosure in CVE-2024-6554 allows attackers to access sensitive file paths in the server, leading to potential data exposure.
Which versions of the Branda plugin are affected by CVE-2024-6554?
All versions of the Branda plugin up to and including 3.4.18 are affected by CVE-2024-6554.
Who is the vendor for the affected software in CVE-2024-6554?
The vendor for the affected software in CVE-2024-6554 is WPMU DEV.