PT-2024-38101 · WordPress · Tainacan

🗓️ 31 Jul 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 6 Views

Vulnerability in the Tainacan WordPress plugin up to version 0.21.7 allows authenticated subscribers to read server files via the get file function and directory traversal.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Missing Authorization in Tainacan	11 Oct 202410:56	–	githubexploit
Circl	CVE-2024-7135	31 Jul 202414:19	–	circl
CNNVD	WordPress plugin Tainacan 安全漏洞	31 Jul 202400:00	–	cnnvd
CVE	CVE-2024-7135	31 Jul 202410:59	–	cve
Cvelist	CVE-2024-7135 Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read	31 Jul 202410:59	–	cvelist
NVD	CVE-2024-7135	31 Jul 202411:15	–	nvd
Patchstack	WordPress Tainacan Plugin <= 0.21.7 is vulnerable to Arbitrary File Download	31 Jul 202400:00	–	patchstack
Patchstack	WordPress Tainacan plugin <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read vulnerability	31 Jul 202403:18	–	patchstack
RedhatCVE	CVE-2024-7135	23 May 202510:21	–	redhatcve
Vulnrichment	CVE-2024-7135 Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read	31 Jul 202410:59	–	vulnrichment

Source	Link
osv	www.osv.dev/vulnerability/CVE-2024-7135
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-7135
t	www.t.me/cvedetector/2133
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e4dd0c6a-75af-4b53-ac13-fc4ef0e9001d
plugins	www.plugins.trac.wordpress.org/browser/tainacan/trunk/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php
t	www.t.me/cvenotify/88036
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
plugins	www.plugins.trac.wordpress.org/browser/tainacan/trunk/classes/api/endpoints/class-tainacan-rest-background-processes-controller.php
plugins	www.plugins.trac.wordpress.org/changeset/3127693

31 Jul 2024 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.5

EPSS0.47957

SSVC