CVE-2024-6499 WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure
Unauthenticated attackers can obtain the full server path, aiding reconnaissance and potentially facilitating further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6499?
CVE-2024-6499 is a medium-severity vulnerability in maxfoundry MaxButtons – Create buttons, published on 24 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Weakness: CWE-200
Which versions are affected by CVE-2024-6499?
It affects 1 product.
Products include Maxfoundry Maxbuttons.
How do I fix CVE-2024-6499?
No fix has been published for CVE-2024-6499 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-6499 being exploited?
There is no known exploitation of CVE-2024-6499 in the wild and no public exploit code.
Other vulnerabilities in maxfoundry MaxButtons – Create buttons
- CVE-2023-36503 WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-7029 WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- CVE-2024-3026 WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS
- CVE-2024-10555 MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width
- CVE-2024-8968 MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color
Sources
Also known as GHSA-c9x2-m7q5-frxf.