CVE-2024-11219mediumCWE-22

CVE-2024-11219: medium-severity vulnerability in themeisle Otter Blocks – Gutenberg Blocks…

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View

Published · Updated

Follow this CVE+ Monitor Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
In short

An attacker can view any image file on a WordPress server without logging in by exploiting a flaw in the Otter Blocks plugin. This could expose sensitive images stored on the server.

Technical detail

The plugin's get_image function is vulnerable to path traversal (CWE-22), allowing unauthenticated attackers to bypass directory restrictions and access arbitrary image files. The vulnerability requires only HTTP requests and can disclose sensitive image data without authentication.

Summary generated and translated by AI from the official description.
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to view arbitrary images on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
themeisle · Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Related CVEs — themeisle Otter Blocks – Gutenberg Blocks…

In the same product, most dangerous first.

CVE-2024-1047MEDIUMThemeIsle SDK <= Various Versions - Missing AuthorizationEPSS 0.6%CVE-2024-3725MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'EPSS 0.4%CVE-2026-4945MEDIUMOtter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification BypassEPSS 0.4%CVE-2024-2226MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-10367MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-3343MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.3%