
Cloud Vulnerability DB
A community-led vulnerabilities database
The Gravity Forms: Multiple Form Instances plugin for WordPress contains a Full Path Disclosure vulnerability (CVE-2024-6550) affecting all versions up to and including 1.1.1. The vulnerability was discovered and reported by Wordfence, with the disclosure date being July 10, 2024 (NVD Database).
The vulnerability stems from the plugin leaving test files with display_errors enabled. This configuration issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity and no required privileges or user interaction (NVD Database).
When exploited, this vulnerability allows unauthenticated attackers to retrieve the full path of the web application. While the exposed information is not directly harmful on its own, it can be leveraged to aid in other attacks. The vulnerability requires another security weakness to be present for any significant damage to occur (NVD Database).
The vulnerability can be exploited by unauthenticated attackers who can access the affected test files. The attack vector is network-accessible and requires no special privileges or user interaction to exploit (NVD Database).
Website administrators running the Gravity Forms: Multiple Form Instances plugin should update to a version newer than 1.1.1 if available, or consider removing the test files with display_errors enabled (NVD Database).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."