WordPress Plugin Vulnerabilities

LiteSpeed Cache < 6.5.1 - Author+ Path Traversal

Description

The plugin is vulnerable to Path Traversal, allowing authenticated attackers, with author-level access and above, to perform actions on files outside of the originally intended directory.

Affects Plugins

Plugin icon
litespeed-cache
Fixed in 6.5.1

References

CVE
CVE-2024-47637
URL
https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-4-1-path-traversal-vulnerability

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
TaiYou
Verified
No
WPVDB ID
94393d19-1e92-4a69-b0d3-7d5a8d14ab16

Timeline

Publicly Published
2024-09-30 (about 2 years ago)
Added
2024-10-11 (about 2 years ago)
Last Updated
2024-10-11 (about 2 years ago)

Other

Published
Title
Published
2024-12-17
Title
WPLMS < 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary Directory Deletion
Published
2025-01-24
Title
ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read
Published
2025-04-04
Title
Streamit < 4.0.2 - Authenticated (Subscriber+) Arbitrary File Download
Published
2026-03-20
Title
EmailKit < 1.6.4 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
Published
2017-09-19
Title
WordPress 4.4-4.8.1 - Path Traversal in Customizer