CVE-2024-8104

Name of the Vulnerable Software and Affected Versions: WP Extended plugin for WordPress versions up to, and including, 3.0.8

Description: The issue allows authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensitive information, via the download file ajax function. This enables potential exposure of sensitive data on the server.

Recommendations: For WP Extended plugin for WordPress versions up to, and including, 3.0.8, update to version 3.0.9 to secure your site. As a temporary workaround, consider disabling the download file ajax function until a patch is available.