PT-2025-2135 · WordPress · Sandbox

Stiofan + 1 · Published 2025-01-17 · Updated 2025-01-17 · CVE-2024-13367

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Sandbox plugin for WordPress versions up to, and including, 0.4

Description The issue arises from a missing capability check on the export download action, allowing authenticated attackers with Subscriber-level access and above to download a complete copy of a sandbox environment. This environment can contain sensitive information, such as the wp-config.php file.

Recommendations For versions up to, and including, 0.4, consider disabling the export download action until a patch is available to prevent unauthorized access. Restrict access to the sandbox environment to minimize the risk of exploitation. Avoid using the export download action in the affected plugin until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13367

Affected Products

Sandbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-13367 · Security Note
• https://t.me/cvedetector/15684 · Telegram Post
• https://plugins.trac.wordpress.org/browser/sandbox/trunk/sandbox-ajax.php#L21 · Note
• https://twitter.com/VulmonFeeds/status/1880176444204028114 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/59880d92-5d75-432f-9fb5-d74b13d101ff?source=cve · Note
• https://twitter.com/CVEnew/status/1880248068676940005 · Twitter Post