PT-2024-37701 · WordPress · Custom Post Limits

Matthew Rollings + 1 · Published 2024-09-13 · Updated 2024-09-30 · CVE-2024-6544

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Custom Post Limits plugin for WordPress versions up to, and including, 4.4.1

Description The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure. This issue arises because the plugin utilizes bootstrap and leaves test files with display errors on, making it possible for unauthenticated attackers to retrieve the full path of the web application. Although the information displayed is not useful on its own, it can aid other attacks if another vulnerability is present.

Recommendations For versions up to, and including, 4.4.1: Update the plugin immediately to prevent potential exploitation. Additionally, monitor for signs of compromise as a precautionary measure. As a temporary workaround, consider disabling the display errors feature in the plugin's configuration until a patch is available.

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

CVE-2024-6544

Affected Products

Custom Post Limits

References · 8

• https://osv.dev/vulnerability/CVE-2024-6544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6544 · Security Note
• https://twitter.com/VulmonFeeds/status/1834643339078975514 · Twitter Post
• https://plugins.trac.wordpress.org/browser/custom-post-limits/trunk/tests/bootstrap.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9cf4a11e-ad28-4a93-9278-1d2d113a4859?source=cve · Note
• https://twitter.com/CVEnew/status/1834633845351817392 · Twitter Post
• https://twitter.com/oktsec/status/1834536060841263598 · Twitter Post
• https://t.me/cvedetector/5610 · Telegram Post