CVE-2024-13539

Summary

CVE-2024-13539: The AForms Eats plugin for WordPress, versions up to 1.3.1, suffers from a Full Path Disclosure vulnerability. This issue stems from the publicly accessible /vendor/aura/payload-interface/phpunit.php file, which exhibits error messages. These error messages expose the web application's full path to unauthenticated attackers. While the information disclosed is not damaging on its own, an attacker would need to exploit another vulnerability to harm an affected website.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.