Technical impact
The vulnerability stems from insufficient file path validation in the ajax_attach_file function of the WP Customer Area plugin, allowing an authenticated user with a role granted by an administrator (e.g., Subscriber) to request arbitrary file paths. An attacker can read any file on the server, including sensitive configuration files, or delete files, which could lead to remote code execution if critical files such as wp-config.php are removed. This flaw impacts confidentiality by exposing file contents and integrity by permitting deletion, and can cause availability issues if essential files are destroyed.
Affected Systems
The affected product is the WP Customer Area WordPress plugin from Aguilatechnologies. All releases up to and including version 8.3.4 are vulnerable. Users with Subscriber or higher roles who have been granted permission to access the file attachment functionality can exploit the flaw. No other vendors or plugins are mentioned.
Risk and Exploitability
The flaw has a CVSS score of 8.8, classifying it as high severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, but the potential for exploitation remains significant. The likely attack vector is an authenticated AJAX request to the ajax_attach_file endpoint; attackers need only a legitimate credential with an authorized role, after which they can specify arbitrary file paths. Successful exploitation could result in data theft, unauthorized file deletion, or remote code execution if core WordPress files are removed.
