CVE-2024-12849

CVE-2024-12849 is an arbitrary file read vulnerability (CWE-22) in the Error Log Viewer By WP Guru plugin for WordPress, affecting all versions up to and including 1.0.1.3. The flaw exists in the wp_ajax_nopriv_elvwp_log_download AJAX action, which fails to properly restrict file access, enabling attackers to retrieve the contents of arbitrary files on the affected server.

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation allows reading sensitive files stored on the server, potentially exposing confidential information such as configuration data or other server contents.

Advisories reference specific code locations in the vulnerable plugin version at lines 295 and 479 of error-log-viewer-wp.php, along with WordPress plugin trac changeset 3215563, which likely addresses the issue. The Wordfence threat intelligence page provides additional vulnerability details, and mitigation requires updating to a version beyond 1.0.1.3.