Technical impact
An improper limitation of pathname to a restricted directory flaw in the Infility Global WordPress plugin permits an attacker to craft a request that includes a traversal sequence, enabling the download of arbitrary files from the server. This path traversal vulnerability can expose sensitive files such as configuration data, passwords, or other confidential information. The weakness is classified as CWE-22.
Affected Systems
Infility: Infility Global plugin is affected. The vulnerability applies to all versions from the plugin’s earliest release up through 2.15.06. No versions beyond 2.15.06 have been confirmed to contain the flaw.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely remote via a web request to the plugin’s endpoint that accepts a path parameter; it is inferred that authentication is not required, though the origin description does not explicitly state this. Exploitation would involve manipulating the path to read files outside the intended directory.
EUVD