CVE-2024-7135

The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_file' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

2.67% chance of exploitation in the next 30 days, 85th percentile

Published

2024-07-31

Updated

2026-04-08

Proof-of-concept exploits (2)

• Nxploited/CVE-2024-71350★ · 2025-01-01
• RandomRobbieBF/CVE-2024-71351★ · 2024-10-11

References

• CVE Record
• NVD entry

Related

• CVE-2024-7133
• CVE-2024-7151
• CVE-2024-7132
• CVE-2024-7152
• CVE-2024-7129
• CVE-2024-7153