Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-3673

CWE-22 — Path Traversal4 documents4 sources
Severity
9.1CRITICAL
EPSS
92.1%
top 0.30%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unknown WEB Directory FreeSalephpscripts WEB Directory Free
Timeline
PublishedAug 30

Description

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5unknown/web_directory_free< 1.7.3

🔴Vulnerability Details

2
GHSA
GHSA-8pqc-xcjc-j8v3: The Web Directory Free WordPress plugin before 1↗2024-08-30
▶
CVEList
Web Directory Free < 1.7.3 - Unauthenticated LFI↗2024-08-30
▶

💥Exploits & PoCs

1
Nuclei
Web Directory Free < 1.7.3 - Local File Inclusion
▶