What is the CVSS score of CVE-2024-12849?

CVE-2024-12849 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 93.0%.

Which versions of WordPress are affected by CVE-2024-12849?

Organizations using for WordPress is vulnerable to Arbitrary File Read in all face notable risk from CVE-2024-12849, a path traversal vulnerability rated CVSS 7.5.

Is there a public PoC exploit available for CVE-2024-12849?

Yes, a public proof-of-concept exploit is available for CVE-2024-12849. Prioritise patching immediately. EPSS: 93.0%.

How to fix or mitigate CVE-2024-12849?

Within 30 days: Identify all affected systems running for WordPress is vulnerable to Arbitrary File Read in all and apply vendor patches as part of regular patch cycle. Review file handling controls and restrict upload directories.

WordPress CVE-2024-12849

HIGH

Path Traversal (CWE-22)

2025-01-07 security@wordfence.com

WordPress Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:02 vuln.today

CVE Published

Jan 07, 2025 - 06:15 nvd

HIGH 7.5

DescriptionCVE.org

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

The Error Log Viewer By WP Guru plugin for WordPress through version 1.0.1.3 exposes an unauthenticated AJAX endpoint that allows arbitrary file read via path traversal. Attackers can extract wp-config.php, database credentials, and any file readable by the web server process.

Technical ContextAI

The wp_ajax_nopriv_elvwp_log_download AJAX action accepts a filename parameter without proper path validation. By injecting directory traversal sequences (../), an attacker can read any file on the server that the web server process has permission to access. The nopriv registration means no WordPress authentication is required.

Affected ProductsAI

Error Log Viewer By WP Guru <= 1.0.1.3 WordPress sites with plugin installed

RemediationAI

Remove or deactivate the Error Log Viewer By WP Guru plugin immediately. Rotate database credentials and WordPress authentication keys/salts. Review access logs for requests to the elvwp_log_download AJAX action.