CVE-2024-7412: 
WordPress vulnerability analysis and mitigation

The No Update Nag plugin for WordPress contains a Full Path Disclosure vulnerability affecting all versions up to and including 1.4.12. The vulnerability was discovered and disclosed on August 12, 2024 (Wordfence Advisory).

The vulnerability exists due to the plugin allowing direct access to the bootstrap.php file with display_errors enabled. This configuration issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (NVD Database).

The vulnerability allows unauthenticated attackers to retrieve the full path of the web application. While this information alone is not directly harmful, it can be leveraged to aid other attacks when combined with additional vulnerabilities (Wordfence Advisory).

Site administrators running affected versions of the No Update Nag plugin should update to a version newer than 1.4.12 when available. Until a patch is released, consider disabling the plugin if it's not critical to site operations (NVD Database).