PT-2025-20380 · Unknown · Wp Page Builder

Bruno López · Published 2025-05-08 · Updated 2025-05-08 · CVE-2024-6648

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AP Page Builder versions prior to 4.0.0

Description The issue is an Absolute Path Traversal vulnerability that could allow an unauthenticated remote user to modify the product item path within the config JSON file, allowing them to read any file on the system.

Recommendations For AP Page Builder versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the config JSON file to prevent modification of the product item path.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-6648

Affected Products

Wp Page Builder

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6648 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6648 · Vendor Advisory
• https://twitter.com/cybercronai/status/1920507835198136567 · Twitter Post
• https://t.me/cvetracker/23354 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/path-traversal-ap-page-builder · Note
• https://t.me/cvenotify/121333 · Telegram Post
• https://t.me/cvedetector/24826 · Telegram Post
• https://twitter.com/CVEnew/status/1920455869000720799 · Twitter Post
• https://twitter.com/incibe_cert/status/1920451015892967445 · Twitter Post