Ultimate Video Player <= 10.0 - Unauthentifizierter willkürlicher Datei-Download

Successful exploitation of CVE-2024-10804 could allow an attacker to gain access to sensitive data stored on the web server. This could include configuration files containing database passwords, API keys, or other credentials. The attacker could also potentially access source code, which could reveal further vulnerabilities. While the vulnerability requires no authentication, the impact can be significant depending on the data accessible on the server. This vulnerability shares similarities with other directory traversal exploits where attackers leverage flawed file path handling to bypass access controls.

Websites utilizing the Ultimate Video Player plugin, particularly those running older versions (≤10.0), are at risk. Shared hosting environments are especially vulnerable as they often have limited control over file permissions and server configurations. WordPress sites with sensitive data stored on the same server are also at increased risk.

• wordpress / composer / npm:

grep -r 'content/downloader.php' /var/www/html/

• generic web:

curl -I https://your-wordpress-site.com/content/downloader.php | grep -i 'content-type'

• wordpress / composer / npm:

wp plugin list | grep "Ultimate Video Player"

1. 2025-03-07Disclosure

   disclosure

1. Reserviert2024-11-04
2. Veröffentlicht2025-03-07
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-10804 is to upgrade the Ultimate Video Player WordPress plugin to a version that includes the fix. If upgrading immediately is not possible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting access to the content/downloader.php file using .htaccess rules or a web application firewall (WAF). Monitor web server access logs for suspicious requests targeting the content/downloader.php file. After upgrading, confirm the vulnerability is resolved by attempting to access a non-existent file through the content/downloader.php endpoint and verifying that access is denied.