CVE-2024-10804

High

Published: 07 March 2025

Published

07 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0185 83.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-10804 is a high-severity Path Traversal (CWE-22) vulnerability in Codecanyon (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-10804 is a directory traversal vulnerability (CWE-22) in the Ultimate Video Player WordPress & WooCommerce Plugin for WordPress, affecting all versions up to and including 10.0. The flaw exists in the content/downloader.php file, allowing unauthenticated attackers to read the contents of arbitrary files on the server, potentially exposing sensitive information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability disruption.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges or user interaction required. By sending crafted requests to the vulnerable downloader.php endpoint, they can traverse directories and access files outside the intended scope, such as configuration files, wp-config.php, or other server-stored data containing sensitive details.

Advisories and further details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/5394abc6-836f-4b22-a7b6-79d092b93a7e?source=cve and the plugin page on CodeCanyon at https://codecanyon.net/item/ultimate-video-player-wordpress-plugin/8374433. The CVE was published on 2025-03-07T09:15:13.340.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-54130

Vulnerability details

The Ultimate Video Player WordPress & WooCommerce Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 10.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of…

arbitrary files on the server, which can contain sensitive information.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

The path traversal vulnerability in a public-facing WordPress plugin enables remote unauthenticated exploitation of the application (T1190) and direct reading of arbitrary local system files including sensitive configs (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0