CVE-2024-9546— WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure
Quick assessment
Affected
xplodedthemes WPIDE – File Manager & Code Editor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin WPIDE 3.4.9及之前版本存在信息泄露漏洞，该漏洞源于插件使用的PHP-Parser库输出了解析重建命令的结果，这使得未认证的攻击者能够获取Web应用程序的完整路径，进而辅助其他攻击。
Possible ATT&CK Techniques 2 AI
T1592 · Gather Victim Host Information T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-9546
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure
Source: CVE Program / CVE List V5
Vulnerability Description
The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin WPIDE 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin WPIDE 3.4.9及之前版本存在信息泄露漏洞，该漏洞源于插件使用的PHP-Parser库输出了解析重建命令的结果，这使得未认证的攻击者能够获取Web应用程序的完整路径，进而辅助其他攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xplodedthemes | WPIDE – File Manager & Code Editor | * ~ 3.4.9 | - |
|
II. Public POCs for CVE-2024-9546
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-9546
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: xplodedthemes
-
CVE-2026-66440
WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 -
CVE-2026-57766
WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 -
CVE-2024-9178
XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (A -
CVE-2024-8716
XT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cro -
CVE-2022-40217
WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File
Same weakness: CWE-200
-
CVE-2026-105030
Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via -
CVE-2026-104476
Backdrop CMS before 1.35.1 Information Disclosure via Config -
CVE-2026-103627
Google Chrome <154.0.8037.97 SVG信息泄露漏洞 -
CVE-2026-104455
YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplu -
CVE-2026-103763
SiYuan before v3.8.5 Information Disclosure via /api/noteboo
V. Comments for CVE-2024-9546
No comments yet