CVE-2024-13617

Description

The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server

Reserved 2025-01-22 | Published 2025-03-25 | Updated 2025-03-25 | Assigner WPScan

Problem types

CWE-552 Files or Directories Accessible to External Parties

Product status

Default status
affected

Any version
affected

Credits

Aly Khaled finder

WPScan coordinator

References

wpscan.com/...rability/8d6dd979-21ef-4d14-9c42-bbd1d7b65c53/ exploit vdb-entry technical-description

cve.org (CVE-2024-13617)

nvd.nist.gov (CVE-2024-13617)

Download JSON