CVE-2024-6573: 
WordPress vulnerability analysis and mitigation

The Intelligence plugin for WordPress contains a Full Path Disclosure vulnerability (CVE-2024-6573) affecting all versions up to and including 1.4.0. The vulnerability was discovered and disclosed on July 26, 2024. This security issue affects WordPress installations using the Intelligence plugin (NVD CVE).

The vulnerability stems from the plugin's failure to prevent direct access to the /vendor/levelten/intel/realtime/index.php file combined with enabled display_errors setting. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. It is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (Wordfence Intel).

The vulnerability allows unauthenticated attackers to retrieve the full path of the web application. While the exposed information is not directly harmful on its own, it could be leveraged to aid in other attacks. The impact is considered moderate as it requires additional vulnerabilities to cause significant damage to affected websites (NVD CVE).

The vulnerability can be exploited by unauthenticated attackers through direct access to specific plugin files. The low complexity (AC:L) and no requirements for privileges (PR:N) or user interaction (UI:N) make this vulnerability relatively easy to exploit (Wordfence Intel).

Website administrators running the Intelligence plugin should update to a version newer than 1.4.0 if available. Additionally, disabling the display_errors setting in PHP configuration can help mitigate the vulnerability (NVD CVE).