CVE-2024-6554: 
WordPress vulnerability analysis and mitigation

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress (CVE-2024-6554) contains a Full Path Disclosure vulnerability affecting all versions up to and including 3.4.18. This vulnerability was discovered and reported by Wordfence, with initial disclosure on July 11, 2024 (NVD).

The vulnerability stems from the plugin's implementation of composer without proper access restrictions to files. This security flaw allows unauthenticated attackers to retrieve the full path of the web application. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (Wordfence).

The vulnerability allows attackers to obtain the full path of the web application. However, the disclosed information alone is not directly harmful but could potentially be used to aid other attacks. The impact is considered moderate as it requires additional vulnerabilities to cause significant damage to affected websites (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is low, making it relatively straightforward to exploit (Wordfence).

A patch has been released to address this vulnerability. Users should upgrade to version 3.4.19 or later of the Branda plugin to mitigate this security issue (NVD).