Unrated severityNVD Advisory· Published Jan 8, 2025· Updated Apr 8, 2026

InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading

CVE-2024-10585

Description

The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Infinitewp/Infinitewpllm-fuzzy
Range: <=1.13.0
Revmakx/Infinitewp Clientcpe-rescue
Range: 0
WordPress/Infinitewpwp-canonicalize

Patches

Vulnerability mechanics

References

plugins.svn.wordpress.org/iwp-client/tags/1.13.0/debug-chart/index.phpmitre
plugins.trac.wordpress.org/changeset/3202851/iwp-client/trunk/debug-chart/index.phpmitre
www.wordfence.com/threat-intel/vulnerabilities/id/4d2518f6-3647-4bee-a98c-ce7f30375a62mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000