CVE-2024-7135: Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7135?
CVE-2024-7135 has a moderate severity level due to unauthorized data access risks.
How do I fix CVE-2024-7135?
To fix CVE-2024-7135, update the Tainacan plugin for WordPress to version 0.21.8 or higher.
What is the impact of CVE-2024-7135?
The impact of CVE-2024-7135 includes unauthorized access to sensitive data and potential directory traversal attacks.
Who is affected by CVE-2024-7135?
All users of the Tainacan plugin for WordPress versions up to and including 0.21.7 are affected by CVE-2024-7135.
What functionalities are exploited in CVE-2024-7135?
CVE-2024-7135 exploits the 'get_file' function which lacks proper capability checks.