CVE-2024-39619: 
WordPress vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2024-39619) was discovered in CridioStudio's ListingPro WordPress plugin affecting versions through 2.9.3. The vulnerability was disclosed on July 22, 2024, and allows for PHP Local File Inclusion attacks. This security issue received a Critical CVSS v3.1 base score of 9.8 (NVD, Patchstack).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue, identified as CWE-22. It received two different CVSS v3.1 scores: a 9.8 (Critical) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a 9.0 (Critical) from Patchstack with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability could allow an unauthenticated attacker to include local files of the target website and display their contents. This could potentially expose sensitive information such as database credentials, depending on the configuration, which could lead to complete database compromise (Patchstack).

The vulnerability requires no authentication to exploit and has been classified as highly dangerous with an expectation of mass exploitation. The attack complexity is rated as low by NVD and high by Patchstack, but in both cases, no user interaction is required for exploitation (Patchstack).

Users are advised to update to ListingPro version 2.9.5 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).