A path traversal vulnerability in the wp-media-folder-addon WordPress plugin allows unauthenticated attackers to read arbitrary files, posing a high risk to server security.

The plugin fails to properly sanitize input, leading to a path traversal vulnerability (CWE-22). This allows an unauthenticated attacker to manipulate file paths and access restricted directories or files on the underlying filesystem.

The CVSS score of 8.6 indicates a high-severity risk. Successful exploitation could result in the disclosure of sensitive configuration files, database credentials, or other private data stored on the server, leading to a complete compromise of the WordPress environment.

Immediate Action: Update the wp-media-folder-addon plugin to the latest version immediately. If an update is not available, disable the plugin until a security patch is verified.

Proactive Monitoring: Inspect web server access logs for directory traversal patterns, such as sequences of dot-dot-slash (../) characters, targeted at the plugin's file handling endpoints.

Compensating Controls: Implement WAF rules to detect and drop requests containing path traversal sequences to prevent the exploit from reaching the application.

Public Exploit Available: No (exploit_available: false)

Given the unauthenticated nature of this vulnerability and the potential for full file system disclosure, immediate remediation is required. Organizations should treat this as a high-priority update to protect sensitive server-side information from unauthorized access.