CVE-2024-35781: 
WordPress vulnerability analysis and mitigation

The CVE-2024-35781 vulnerability affects YAHMAN Word Balloon WordPress plugin versions up to and including 4.21.1. This security issue is classified as an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that allows PHP Local File Inclusion (NVD, Patchstack).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue requires contributor-level access or above to exploit (WPScan).

This vulnerability allows authenticated attackers with contributor-level access to include and execute arbitrary files on the server. This can potentially lead to bypassing access controls, obtaining sensitive data, or achieving code execution in cases where images and other 'safe' file types can be uploaded and included (WPScan).

The vulnerability requires authenticated access with contributor-level privileges or higher to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) with no user interaction (UI:N) (NVD).

The vulnerability has been patched in version 4.22.0 of the Word Balloon plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).