7.5
HighCVSS 3.1 · from Wordfence
CVE-2024-8352
Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download
Social Web Suite – Social Media Auto Post, Social Media Auto Publish · Path traversal · CWE-22AffectedSocial Web Suite – Social Media Auto Post, Social Media Auto Publish
FixNo fix listed yet.
PublishedOct 3, 2024, 03:32 · Wordfence
ScoredOct 3, 2024 · 7.5 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data. CVSS impact.
Description
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
From Wordfence
Affected and fixed versions
ProductAffectedFixed inSocial Web Suite – Social Media Auto Post, Social Media Auto Publishup to 4.1.11–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known