CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-10585: InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
5.3
CVSS
Description
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.
Classification
CVE ID: CVE-2024-10585
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
Affected Products
Vendor: revmakx
Product: InfiniteWP Client
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 23.26% (scored less or equal to compared to others)
EPSS Date: 2025-02-06 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2518f6-3647-4bee-a98c-ce7f30375a62?source=cvehttps://plugins.svn.wordpress.org/iwp-client/tags/1.13.0/debug-chart/index.php
https://plugins.trac.wordpress.org/changeset/3202851/iwp-client/trunk/debug-chart/index.php