CVE-2024-6556: SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.10.8. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6556?
CVE-2024-6556 is classified as a high severity vulnerability due to its potential for Full Path Disclosure.
How do I fix CVE-2024-6556?
To fix CVE-2024-6556, update the SmartCrawl WordPress SEO checker plugin to version 3.10.9 or higher.
What is the impact of CVE-2024-6556 on my website?
CVE-2024-6556 can expose sensitive file paths, which may aid attackers in exploiting further vulnerabilities.
Which versions of SmartCrawl are affected by CVE-2024-6556?
All versions of the SmartCrawl WordPress SEO checker up to and including 3.10.8 are affected by CVE-2024-6556.
Is there a workaround for CVE-2024-6556?
Currently, the only recommended approach for CVE-2024-6556 is to update to the latest version of the plugin.