CVE-2024-5637: 
WordPress vulnerability analysis and mitigation

The Market Exporter plugin for WordPress (CVE-2024-5637) contains a vulnerability due to a missing capability check on the 'remove_files' function in versions up to and including 2.0.19. This security flaw was discovered and reported by Wordfence, with the initial disclosure made on June 7, 2024 (Wordfence Advisory).

The vulnerability stems from a missing capability check in the 'remove_files' function, which allows for path traversal attacks. The issue has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H by NIST NVD. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to perform path traversal attacks, potentially leading to the deletion of arbitrary files on the server. This could result in significant data loss and system disruption (NVD).

The vulnerability is exploitable by any authenticated user with Subscriber-level privileges or higher. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit (NVD).

A patch has been released to address this vulnerability. Users should update to version 2.0.20 or later of the Market Exporter plugin to mitigate this security risk (WordPress Plugin).