CVE-2024-12849: Arbitrary File Access in Error Log Viewer

The Arbitrary File Read vulnerability allows an attacker to bypass access controls and retrieve files from the server's file system. This could include configuration files, database credentials, source code, or other sensitive data. Successful exploitation could lead to complete compromise of the WordPress instance and potentially the underlying server. The attacker does not need to be authenticated to exploit this vulnerability, significantly expanding the potential attack surface. The impact is amplified if the server stores sensitive data in easily accessible locations, or if the WordPress installation has weak file permissions.

1. Reserved2024-12-20
2. Published2025-01-07
3. EPSS updated2026-04-02

The primary mitigation is to immediately update the Error Log Viewer By WP Guru plugin to a version that addresses this vulnerability. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting access to the wpajaxnoprivelvwplog_download AJAX endpoint using a WordPress security plugin or custom code. Review file permissions on the server to ensure that sensitive files are not world-readable. Implement a Web Application Firewall (WAF) with rules to block suspicious requests targeting the vulnerable endpoint. After upgrading, verify the fix by attempting to access a non-existent file via the vulnerable AJAX endpoint; it should return an error, not file contents.

Active installs

100

Plugin rating