Cyber Posture

CVE-2024-10804

High

Published: 07 March 2025

Published
07 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0185 83.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2024-10804 is a directory traversal vulnerability (CWE-22) in the Ultimate Video Player WordPress & WooCommerce Plugin for WordPress, affecting all versions up to and including 10.0. The flaw exists in the content/downloader.php file, allowing unauthenticated attackers to read the contents of arbitrary files on the server, potentially exposing sensitive information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability disruption.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges or user interaction required. By sending crafted requests to the vulnerable downloader.php endpoint, they can traverse directories and access files outside the intended scope, such as configuration files, wp-config.php, or other server-stored data containing sensitive details.

Advisories and further details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/5394abc6-836f-4b22-a7b6-79d092b93a7e?source=cve and the plugin page on CodeCanyon at https://codecanyon.net/item/ultimate-video-player-wordpress-plugin/8374433. The CVE was published on 2025-03-07T09:15:13.340.

Details

CWE(s)
CWE-22

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

The path traversal vulnerability in a public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct reading of arbitrary local system files including sensitive configs (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References