Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
In short
An attacker can view any image file on a WordPress server without logging in by exploiting a flaw in the Otter Blocks plugin. This could expose sensitive images stored on the server.
Technical detail
The plugin's get_image function is vulnerable to path traversal (CWE-22), allowing unauthenticated attackers to bypass directory restrictions and access arbitrary image files. The vulnerability requires only HTTP requests and can disclose sensitive image data without authentication.
Summary generated and translated by AI from the official description.
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to view arbitrary images on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N