CVE-2024-6550: 
WordPress vulnerability analysis and mitigation

The Gravity Forms: Multiple Form Instances plugin for WordPress contains a Full Path Disclosure vulnerability (CVE-2024-6550) affecting all versions up to and including 1.1.1. The vulnerability was discovered and reported by Wordfence, with the disclosure date being July 10, 2024 (NVD Database).

The vulnerability stems from the plugin leaving test files with display_errors enabled. This configuration issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity and no required privileges or user interaction (NVD Database).

When exploited, this vulnerability allows unauthenticated attackers to retrieve the full path of the web application. While the exposed information is not directly harmful on its own, it can be leveraged to aid in other attacks. The vulnerability requires another security weakness to be present for any significant damage to occur (NVD Database).

The vulnerability can be exploited by unauthenticated attackers who can access the affected test files. The attack vector is network-accessible and requires no special privileges or user interaction to exploit (NVD Database).

Website administrators running the Gravity Forms: Multiple Form Instances plugin should update to a version newer than 1.1.1 if available, or consider removing the test files with display_errors enabled (NVD Database).