CVE-2024-38746: 
WordPress vulnerability analysis and mitigation

A Path Traversal vulnerability has been identified in MakeStories Team MakeStories (for Google Web Stories) WordPress plugin, tracked as CVE-2024-38746. The vulnerability affects versions through 3.0.3 of the plugin and was discovered by security researcher Majed Refaea. The issue was publicly disclosed on July 11, 2024, and allows for Path Traversal and Server Side Request Forgery (SSRF) attacks (Patchstack Database).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue, identified as CWE-22. It has received a CVSS v3.1 base score of 7.1 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The vulnerability requires a low level of privileges (Subscriber) to exploit (Patchstack Database).

The vulnerability could allow malicious actors to perform arbitrary file downloads from the affected website. This could potentially expose sensitive information, including login credentials and backup files. The high CVSS score indicates that this vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack Database).

The vulnerability requires a low level of access (Subscriber privileges) to exploit. According to security assessments, the attack complexity is low, and no user interaction is required for exploitation. The vulnerability is expected to become mass exploited due to its high severity and ease of exploitation (Patchstack Database).

The vulnerability has been fixed in version 3.0.4 of the MakeStories plugin. Users are strongly advised to update to version 3.0.4 or later immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to a fixed version (Patchstack Database).