漏洞描述
Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled display_errors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires display_errors to be enabled.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/forms-for-campaign-monitor/campaign-monitor-for-wordpress-2815-unauthenticated-full-path-disclosure↗wordpress.orghttps://wordpress.org/plugins/forms-for-campaign-monitor/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-6569↗