CVE-2023-1478 Hummingbird < 3.4.2 - Unauthenticated Path Traversal

2023-04-1013:17:59

WPScan

www.cve.org

cve-2023-1478

unauthenticated

path traversal

hummingbird

wordpress plugin

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

58.7%

JSON

The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Hummingbird",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.4.2"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]