CVE-2019-6715

pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2019-04-01

Last modified

2024-08-04

Affected products

• W3 Total Cache (Boldgrid)

References

• http://packetstormsecurity.com/files/160674/WordPress-W3-Total-Cache-0.9.3-File-Read-Directory-Traversal.html
• https://vinhjaxt.github.io/2019/03/cve-2019-6715