CVE-2021-39312: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-39312 affects the True Ranker WordPress plugin (also known as seo-local-rank) versions below 2.2.4. It was publicly disclosed on December 14, 2021, and involves an unauthenticated arbitrary file access vulnerability via path traversal (WPScan).

The vulnerability exists in the ~/admin/vendor/datatables/examples/resources/examples.php file, where the 'src' parameter can be exploited to access arbitrary files, including sensitive configuration files such as wp-config.php. The vulnerability has been assigned a CVSS score of 7.5 (High) and is classified as CWE-22, which relates to path traversal issues (WPScan).

The vulnerability allows unauthorized users to access arbitrary files on the system, including sensitive configuration files such as wp-config.php, which could contain database credentials and other critical WordPress configuration details (WPScan).

A proof of concept exploit has been published and documented under ExploitDB ID 50624. The vulnerability can be exploited without authentication, making it particularly dangerous for exposed WordPress installations (WPScan).

The vulnerability has been fixed in version 2.2.4 of the True Ranker plugin. Site administrators are strongly advised to update to this version or later to protect against potential exploitation (WPScan).