Description

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-12T06:16:25.510Z",
  "pubdate": "2026-09-12T06:16:25.510Z",
  "executiveSummary": "The Yogeta WP Cloud WordPress plugin, in all versions up to and including 1.0, contains an unauthenticated arbitrary file read vulnerability.\nThis security flaw stems from insufficient input validation of user-supplied file paths processed by a file-read function on a public-facing endpoint.\nThe vulnerability allows remote, unauthenticated attackers to bypass authorization controls to retrieve arbitrary files from the underlying server filesystem.\nImpact includes the unauthorized disclosure of sensitive system configuration files, database credentials, application source code, and other proprietary data stored on the web server.\nThe risk is critical as the flaw requires no authentication or special privileges to exploit, making it highly attractive for automated scanning and mass exploitation.\nThe exposure of sensitive credentials or environment variables can facilitate full system compromise or lateral movement within the hosting infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of input validation within the Yogeta WP Cloud plugin. The plugin exposes a public endpoint that accepts user-controlled input intended to specify a file path, which is subsequently passed directly to an internal file-read function.\nBecause the plugin fails to sanitize the input or implement a directory traversal prevention mechanism (such as validating the path against a restrictive allow-list or performing canonicalization to ensure the path resides within a safe, intended directory), it is susceptible to directory traversal attacks.\nAn attacker can craft an HTTP request containing a malicious file path, utilizing sequences such as '../' to escape the intended directory and access sensitive files elsewhere in the server's filesystem.\nThe attack flow proceeds as follows: First, the attacker identifies the public endpoint associated with the Yogeta WP Cloud plugin that handles file retrieval. Second, the attacker submits a GET or POST request to this endpoint, providing a traversal path in the parameter expected by the vulnerable function (e.g., /etc/passwd or wp-config.php). Third, the server, lacking any authorization or privilege checks for this endpoint, executes the file-read function using the unsanitized input. Finally, the contents of the requested file are returned in the HTTP response body, effectively leaking sensitive information to the attacker.\nThis vulnerability is classified as an Unauthenticated Arbitrary File Read, stemming from a lack of proper input validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal').\nThe scope of impact is significant because the web server process typically runs with the permissions of the web user. Any file accessible to the web server user is exposed to the attacker. Common targets include wp-config.php, which contains database credentials, salts, and keys; local environment files (.env); and various system-level configuration files that can be used to further compromise the environment."
}