CVE-2024-35712: 
WordPress vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2024-35712) was discovered in the Jordy Meow Database Cleaner WordPress plugin affecting versions through 1.0.5. The vulnerability was disclosed on June 10, 2024, and allows authenticated users with administrative privileges to perform relative path traversal attacks (Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and received a CVSS v3.1 score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. This indicates that while the vulnerability requires high privileges to exploit, it can be accessed over the network and doesn't require user interaction (NVD).

The vulnerability allows authenticated administrators to perform arbitrary file read operations through path traversal, potentially exposing sensitive files and information on the affected system (Patchstack).

The vulnerability requires administrative privileges to exploit, which significantly limits its potential impact. The attack can be executed remotely over the network but requires authentication with high privileges (Patchstack).

Users are advised to update to version 1.0.6 or later of the Database Cleaner plugin to remediate this vulnerability. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).