CVE-2024-7414: 
WordPress vulnerability analysis and mitigation

The PDF Builder for WPForms plugin for WordPress (CVE-2024-7414) contains a Full Path Disclosure vulnerability affecting all versions up to and including 1.2.116. The vulnerability was discovered and reported by Wordfence, with public disclosure on August 12, 2024 (NVD).

The vulnerability stems from the plugin allowing direct access to the composer-setup.php file with display_errors enabled. This configuration issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability allows unauthenticated attackers to retrieve the full path of the web application. While the exposed information alone is not directly harmful, it could be leveraged to aid other attacks. The impact is considered moderate as the information disclosure requires additional vulnerabilities to cause significant damage to affected websites (NVD).

The vulnerability can be exploited by unauthenticated attackers through direct access to the composer-setup.php file. No special conditions or user interaction is required for exploitation, making it relatively straightforward to exploit (NVD).

Website administrators running the PDF Builder for WPForms plugin should update to a version newer than 1.2.116 if available. If an update is not possible, consider disabling the plugin until a patch is released (NVD).