Severity
High
Analysis Summary
CVE-2024-4388
CAS plugin for WordPress could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to the download.php script containing "dot dot" sequences in the path parameter to download arbitrary files on the system.
Impact
- Information Obtained
Indicators of Compromise
CVE
- CVE-2024-4388
Affected Vendors
WordPress
Affected Products
- CAS plugin for WordPress 1.0.0
Remediation
Refer to WordPress Website for patch, upgrade, or suggested workaround information.