CVE-2024-32111

WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability

State
Published
Severity
5.0 Medium
Published
Jun 25, 2024
Updated
Apr 28, 2026
Reserved
Apr 10, 2024

Read the record on cve.org

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.

Scores

CVSSScoreVectorSource
3.15.0 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LPatchstack

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
WordPressAutomattic
  • 6.5 through 6.5.4Affectedfrom 6.5.5Not affected
  • 6.4 through 6.4.4Affectedfrom 6.4.5Not affected
  • 6.3 through 6.3.4Affectedfrom 6.3.5Not affected
  • 6.2 through 6.2.5Affectedfrom 6.2.6Not affected
  • 6.1 through 6.1.6Affectedfrom 6.1.7Not affected
  • 6.0 through 6.0.8Affectedfrom 6.0.9Not affected
  • 5.9 through 5.9.9Affectedfrom 5.9.10Not affected
  • 5.8 through 5.8.9Affectedfrom 5.8.10Not affected
  • 5.7 through 5.7.11Affectedfrom 5.7.12Not affected
  • 5.6 through 5.6.13Affectedfrom 5.6.14Not affected
  • 5.5 through 5.5.14Affectedfrom 5.5.15Not affected
  • 5.4 through 5.4.15Affectedfrom 5.4.16Not affected
  • 5.3 through 5.3.17Affectedfrom 5.3.18Not affected
  • 5.2 through 5.2.20Affectedfrom 5.2.21Not affected
  • 5.1 through 5.1.18Affectedfrom 5.1.19Not affected
  • 5.0 through 5.0.21Affectedfrom 5.0.22Not affected
  • 4.9 through 4.9.25Affectedfrom 4.9.26Not affected
  • 4.8 through 4.8.24Affectedfrom 4.8.25Not affected
  • 4.7 through 4.7.28Affectedfrom 4.7.29Not affected
  • 4.6 through 4.6.28Affectedfrom 4.6.29Not affected
  • 4.5 through 4.5.31Affectedfrom 4.5.32Not affected
  • 4.4 through 4.4.32Affectedfrom 4.4.33Not affected
  • 4.3 through 4.3.33Affectedfrom 4.3.34Not affected
  • 4.2 through 4.2.37Affectedfrom 4.2.38Not affected
  • 4.1 through 4.1.40Affectedfrom 4.1.41Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.