This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: Unauthenticated Arbitrary File Read via path traversal. <br>💥 **Consequences**: Attackers can read sensitive server files (e.g., config, credentials). CVSS 7.5 (High).
Q2Root Cause? (CWE/Flaw)
🛡️ **Root Cause**: CWE-22 (Path Traversal). <br>🔍 **Flaw**: Missing authorization check in `wp_ajax_nopriv_elvwp_log_download` AJAX action. No input sanitization on file paths.
Q3Who is affected? (Versions/Components)
📦 **Affected**: WordPress Plugin: **Error Log Viewer By WP Guru**. <br>📅 **Versions**: **1.0.1.3 and earlier**. Vendor: wpguruin.
Q4What can hackers do? (Privileges/Data)
🕵️ **Hackers Can**: Read **arbitrary files** on the server. <br>📂 **Data Risk**: Expose sensitive info (DB creds, source code, system configs). No admin login needed.
Q5Is exploitation threshold high? (Auth/Config)
⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: **Unauthenticated** (No login required). <br>🌐 **Access**: Network accessible via AJAX endpoint.
Q6Is there a public Exp? (PoC/Wild Exploitation)
💣 **Public Exp?**: **YES**. <br>🔗 **PoCs**: Available on GitHub (RandomRobbieBF, Nxploited) & Nuclei templates. Automated scanning possible.
Q7How to self-check? (Features/Scanning)
🔍 **Self-Check**: Scan for plugin version `<= 1.0.1.3`. <br>🧪 **Test**: Send crafted request to `wp_ajax_nopriv_elvwp_log_download` with `../../etc/passwd` payload.
Q8Is it fixed officially? (Patch/Mitigation)
🩹 **Fix**: Update plugin to **version > 1.0.1.3**. <br>✅ **Official**: Patch released by vendor (WP Guru). Check WordPress plugin repo.
Q9What if no patch? (Workaround)
🚧 **No Patch?**: **Disable/Deactivate** the plugin immediately. <br>🛑 **Mitigate**: Block AJAX endpoint via WAF or restrict file permissions. Remove if unused.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: **HIGH**. <br>⏳ **Priority**: Patch ASAP. Unauthenticated access makes it easy to exploit. Critical for site integrity.