Technical impact
The vulnerability is an improper limitation of a pathname to a restricted directory, also known as path traversal. It allows an attacker to craft a request that includes a traversal sequence (e.g., \'../\') in a file path parameter handled by the Estatik plugin. This flaw enables local file inclusion, which can expose sensitive configuration files or, if the included file contains code, allow remote code execution. The CVSS score of 7.5 indicates a high severity. The likely attack vector is through a web interface that accepts file paths as user input, making the flaw potentially exploitable from the Internet.
Affected Systems
Any installation of the Estatik WordPress plugin that is version 4.3.0 or earlier is affected. The exact version range is not fully documented, but all releases up to and including 4.3.0 are vulnerable. Users should verify their plugin version and consider an upgrade if possible.
Risk and Exploitability
The EPSS score of less than 1% suggests the current exploitation probability is very low, and the flaw is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. However, the high CVSS score and the straightforward path traversal attack make the risk significant if an attacker can reach the vulnerable endpoint. The flaw is presumably actable by unauthenticated users who can send crafted requests to the plugin’s file handling logic. Prompt remediation is advised to prevent future exploitation.
EUVD