CVE-2024-35754: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-35754) is a Path Traversal vulnerability discovered in Ovic Team's Ovic Importer WordPress plugin affecting versions up to 1.6.3. The vulnerability was disclosed on June 10, 2024, and was identified by researcher Majed Refaea (Patchstack).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue, identified as CWE-22. It received a CVSS v3.1 base score of 6.5 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while Patchstack assigned it a higher CVSS score of 7.5 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could allow attackers to perform arbitrary file downloads from the affected website. This could potentially expose sensitive information including login credentials and backup files (Patchstack).

The vulnerability requires at least Subscriber-level privileges to exploit. According to security researchers, this vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available (Patchstack).