PT-2025-2216 · WordPress · Abc Notation

Muhammad Yudha + 1 · Published 2025-01-24 · Updated 2025-01-25 · CVE-2024-13550

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABC Notation plugin for WordPress versions up to, and including, 6.1.3

Description The issue allows authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information, via the file attribute of the "abcjs" shortcode. This enables access to confidential data.

Recommendations For versions up to, and including, 6.1.3, update to a version higher than 6.1.3 to resolve the issue. As a temporary workaround, consider restricting access to the abcjs shortcode or disabling it until a patch is available. Avoid using the file attribute in the "abcjs" shortcode until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-03230

CVE-2024-13550

Affected Products

Abc Notation

References · 8

• 🔥 https://plugins.svn.wordpress.org/abc-notation/tags/6.1.3/abc-notation.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13550 · Security Note
• https://bdu.fstec.ru/vul/2025-03230 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13550 · Vendor Advisory
• https://t.me/cvedetector/16370 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1883078658190921822 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e53a2b7a-7005-451a-88f2-c23d420b4aad?source=cve · Note
• https://twitter.com/CVEnew/status/1883056226025529671 · Twitter Post