CVE-2024-56055: 
WordPress vulnerability analysis and mitigation

The WPLMS WordPress plugin has been identified with a Path Traversal vulnerability (CVE-2024-56055) that was disclosed on December 17, 2024. This security issue affects all versions of WPLMS before 1.9.9.5.2. The vulnerability allows authenticated users with Contributor-level access or higher to perform arbitrary directory deletion operations on the server (Patchstack, WPScan).

The vulnerability is classified as a Path Traversal: '.../...//'. The issue stems from insufficient file path validation in the WPLMS plugin. According to the CVSS 3.1 scoring system, it has received a severity score of 8.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H. The vulnerability is categorized under CWE-35 (Path Traversal) (Patchstack).

If exploited, this vulnerability could allow malicious actors to delete arbitrary files from the affected website. The deletion of core files could potentially cause the site to break and cease functioning. The impact is particularly concerning as it affects the availability and integrity of the website's file system (Patchstack).

The recommended mitigation is to update the WPLMS plugin to version 1.9.9.5.2 or later, which contains the security fix. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).