CVE-2024-3107: 
NixOS vulnerability analysis and mitigation

The Spectra – WordPress Gutenberg Blocks plugin for WordPress (CVE-2024-3107) contains a Path Traversal vulnerability affecting versions up to and including 2.12.6. The vulnerability was discovered in the get_block_default_attributes function and was publicly disclosed on April 26, 2024 (WPScan).

The vulnerability is classified as a Local File Inclusion (LFI) issue with a CVSS v3.1 score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to read the contents of any files named attributes.php on the server. This could potentially expose sensitive information stored in these files (Wordfence).

The vulnerability requires authentication with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring no user interaction to execute (WPScan).

The vulnerability has been patched in version 2.12.7 of the Spectra – WordPress Gutenberg Blocks plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).