Narnoo Distributor <= 2.5.1 - Path Traversal
highThe Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as th...
- CVSS:
- 7.5
- Affected:
- up to 2.5.1
- Fix:
- No patched version reported
- Disclosed:
- Mar 1, 2022