CVE-2024-9546: 
WordPress vulnerability analysis and mitigation

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This vulnerability was discovered and disclosed on October 14, 2024, and is tracked as CVE-2024-9546 (NVD).

The vulnerability stems from the plugin's use of the PHP-Parser library, which outputs parser rebuild command execution results. This implementation flaw allows unauthenticated attackers to retrieve the full path of the web application. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity and no required privileges or user interaction (Wordfence).

The vulnerability allows attackers to obtain the full path of the web application. However, the disclosed information is not useful on its own and requires another vulnerability to be present for causing damage to an affected website (NVD).

Users should upgrade to version 3.5.0 or later of the WPIDE plugin to address this vulnerability (NVD).