CVE-2019-1010257

CVE-2019-1010257 is an Information Disclosure and Data Modification vulnerability affecting versions 0.24 through 0.27 of the article2pdf WordPress plugin. An attacker can craft a malicious URL to download any known PDF file readable by the web server, which is then deleted. For PHP versions prior to 5.3, this vulnerability also allows for reading arbitrary files through null byte termination. This critical vulnerability has a CVSS score of 9.1, indicating a high severity. It is easily exploitable over the network with low attack complexity and no user interaction required, potentially leading to complete confidentiality and integrity compromise of affected files. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community attention and media coverage.