vulnerability

WordPress Plugin: error-log-viewer-wp: CVE-2024-12849: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:N/A:N)

Published

Jan 6, 2025

Added

May 15, 2025

Modified

May 5, 2026

Description

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Solution

error-log-viewer-wp-plugin-cve-2024-12849

References

https://www.cve.org/CVERecord?id=CVE-2024-12849
https://www.wordfence.com/threat-intel/vulnerabilities/id/57888e36-3a61-4452-b4ea-9db9e422dc2d?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-51150
CVE-2024-12849
https://attackerkb.com/topics/CVE-2024-12849
CWE-22
EUVD-EUVD-2024-51150

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report