CVE-2024-6499: 
WordPress vulnerability analysis and mitigation

The WordPress Button Plugin MaxButtons plugin for WordPress contains an information exposure vulnerability affecting all versions up to and including 9.7.8. The vulnerability was discovered and disclosed in August 2024, impacting WordPress installations using the MaxButtons plugin (NVD).

The vulnerability allows unauthenticated attackers to obtain the full path to WordPress instances through the plugin. This information disclosure vulnerability is tracked as CVE-2024-6499 and has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

While the exposed information is of limited use on its own, attackers may leverage the disclosed full path information in combination with other vulnerabilities or use it to simplify reconnaissance work against affected WordPress installations (NVD).

The vulnerability has been patched in version 9.8.0 of the MaxButtons plugin. Users are advised to update to this version or later to mitigate the information exposure risk (WordPress Plugin).