漏洞描述
The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/RandomRobbieBF/CVE-2024-12849↗www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/57888e36-3a61-4452-b4ea-9db9e422dc2d?source=cve↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-12849↗github.comhttps://github.com/advisories/GHSA-899p-f2mf-g895↗