Technical impact
The WatchTowerHQ plugin for WordPress contains an insufficient path validation flaw in the handle_big_object_download_request function. This flaw allows an attacker who is authenticated as an administrator and possesses a valid access token to read any file on the server by providing a crafted 'wht_download_big_object_origin' parameter. The attacker could expose sensitive data such as database credentials or authentication keys.
Affected Systems
All versions of the WatchTowerHQ WordPress plugin up to and including 3.16.0 are affected. The vulnerability is present in the plugin regardless of the WordPress installation version, and any site running the affected plugin will be susceptible.
Risk and Exploitability
With a CVSS score of 4.9, the vulnerability is considered moderate in severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalogue, further suggesting limited public exploitation. However, the requirement for administrator-level access means that only a subset of users could exploit this vulnerability, and successful exploitation would provide the attacker with read access to arbitrary files on the underlying server, potentially exposing critical configuration files and credentials. Since the flaw is limited to authenticated users, an attacker would first need to compromise or obtain credentials with administrative privileges to trigger the path traversal bug.
