CVE-2024-9546

CVE-2024-9546 is a Full Path Disclosure vulnerability affecting all versions of the WPIDE – File Manager & Code Editor plugin for WordPress up to and including 3.4.9. This flaw allows unauthenticated attackers to retrieve the web application's full path due to the plugin's use of the PHP-Parser library, which exposes parser rebuild command execution results. The vulnerability has a CVSS score of 5.3 (Medium), indicating a low attack complexity and no user interaction required, but its direct impact is limited to information disclosure, requiring another vulnerability for significant damage. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.