CVE-2024-6553: 
WordPress vulnerability analysis and mitigation

The WP Meteor Website Speed Optimization Addon plugin for WordPress contains a Full Path Disclosure vulnerability affecting all versions up to and including 3.4.3. This vulnerability was assigned CVE-2024-6553 and was disclosed in July 2024 (NVD).

The vulnerability stems from the plugin utilizing wpdesk and leaving test files with display_errors enabled. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to retrieve the full path of the web application. While the exposed information alone is not directly harmful, it could potentially be used to aid other attacks. The impact is considered limited as the information disclosed requires another vulnerability to be present for causing damage to an affected website (NVD).

The vulnerability can be exploited by unauthenticated attackers by accessing test files with display_errors enabled. No user interaction is required for exploitation, making it relatively straightforward to exploit (NVD).

Users should upgrade to version 3.4.4 or later of the WP Meteor plugin to address this vulnerability. A patch has been made available through the WordPress plugin repository (WordPress Patch).