CVE-2024-7414

Summary

CVE-2024-7414: WPForms' PDF Builder plugin for WordPress exposes a Full Path Disclosure vulnerability in versions up to 1.2.116. The composer-setup.php file, which contains display_errors, is directly accessible, allowing unauthenticated attackers to retrieve the web application's full path. This information, while not damaging on its own, can aid other attacks when combined with another vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.