PT-2024-16386 · WordPress · Debug Tool
Francesco Carlucci
·
Published
2024-11-08
·
Updated
2024-11-13
·
CVE-2024-10588
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Debug Tool plugin for WordPress versions up to, and including, 2.2
Description
The issue is related to a missing capability check on the
info() function, allowing authenticated attackers with subscriber-level access and above to obtain information from phpinfo(). When WP DEBUG is enabled, this can be exploited by unauthenticated users as well. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.Recommendations
For versions up to, and including, 2.2, update to the latest version to mitigate risks. As a temporary workaround, consider disabling the
info() function until a patch is available. Restrict access to the phpinfo() output to minimize the risk of exploitation. Avoid using the WP DEBUG mode until the issue is resolved.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debug Tool