CVE-2024-7412 is a Full Path Disclosure vulnerability affecting all versions up to and including 1.4.12 of the No Update Nag plugin for WordPress. It allows unauthenticated attackers to retrieve the web application's full path due to direct access to a bootstrap.php file with display_errors enabled. Rated with a CVSS score of 5.3 (MEDIUM), this vulnerability has a low impact on confidentiality and requires no user interaction or privileges. While the disclosed information isn't directly damaging, it can aid in subsequent attacks. Currently, there is no evidence of active exploitation, nor are there any known public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.4.12CPE matchmatch criteria | cpe:2.3:a:coffee2code:no_update_nag:*:*:*:*:*:wordpress:*:* | ||
>= 0, <= 1.4.12CPE match | cpe:2.3:a:coffee2code:no_update_nag:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.