CVE-2024-9224
Published: 01 October 2024
Summary
CVE-2024-9224 is a medium-severity Path Traversal (CWE-22) vulnerability in Kau-Boys Hello World. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Hello World plugin for WordPress is vulnerable to arbitrary file reading in all versions through 2.1.1. The flaw, tracked as CWE-22, resides in the hello_world_lyric() function and permits path traversal that can expose any file readable by the web server process.
Authenticated users with subscriber-level privileges or higher can exploit the issue over the network by supplying crafted input to the affected function, enabling them to retrieve sensitive files such as configuration data or other restricted content without any user interaction required. The vulnerability carries a CVSS 3.1 base score of 6.5.
Public references include the vulnerable code in the plugin repository and a subsequent changeset that addresses the issue, indicating an official update is available to resolve the path traversal.
The associated EPSS score stands at 0.5083 with no recorded increase from its peak value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49803
Vulnerability details
The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the hello_world_lyric() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents…
more
of arbitrary files on the server, which can contain sensitive information.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.