CVE-2024-32111: falha de média gravidade em Automattic WordPress
WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.5%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Automattic · WordPressCVEs relacionadas — Automattic WordPress
No mesmo produto, das mais perigosas para as menos.
CVE-2026-93485HIGHWordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2026-66666MEDIUMWordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerabilityEPSS 0.4%CVE-2024-31111MEDIUMWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%