CVE-2024-10804
Published: 07 March 2025
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2024-10804 is a directory traversal vulnerability (CWE-22) in the Ultimate Video Player WordPress & WooCommerce Plugin for WordPress, affecting all versions up to and including 10.0. The flaw exists in the content/downloader.php file, allowing unauthenticated attackers to read the contents of arbitrary files on the server, potentially exposing sensitive information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability disruption.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges or user interaction required. By sending crafted requests to the vulnerable downloader.php endpoint, they can traverse directories and access files outside the intended scope, such as configuration files, wp-config.php, or other server-stored data containing sensitive details.
Advisories and further details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/5394abc6-836f-4b22-a7b6-79d092b93a7e?source=cve and the plugin page on CodeCanyon at https://codecanyon.net/item/ultimate-video-player-wordpress-plugin/8374433. The CVE was published on 2025-03-07T09:15:13.340.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The path traversal vulnerability in a public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct reading of arbitrary local system files including sensitive configs (T1005).