CVE-2024-9939

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin versions up to 4.24.13

Description The WordPress File Upload plugin is vulnerable to Path Traversal, allowing unauthenticated attackers to read files outside of the originally intended directory through wfu file downloader.php. This issue affects all versions up to, and including, 4.24.13.

Recommendations For versions up to 4.24.13, update to a version later than 4.24.13 to resolve the issue. As a temporary workaround, consider restricting access to wfu file downloader.php to minimize the risk of exploitation.