Droip CVE-2024-43955

No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the Themeum Droip plugin installed and active at a version below 2.5.2 (CVSS AV:N/AC:L/PR:N/UI:N). The principal limiting factor is the prevalence of the plugin itself: only sites that have installed and activated Droip are exposed, and the affected endpoint must be reachable from the attacker (it is by default on public WordPress sites). No specific theme, configuration toggle, or platform constraint is indicated in the available data.

The signals are largely aligned toward elevated priority: CVSS 10.0 with AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated reachability, and the scope-changed Confidentiality:High and Availability:High impacts suggest the traversal can affect resources beyond the plugin's own security authority (the wider WordPress install or host). EPSS at 1.13% (78th percentile) is moderate - above baseline but not in the top tail - and the vulnerability is not in CISA KEV nor associated with a public PoC, so there is no public exploit identified at time of analysis. A notable tension: the CVSS vector reports Integrity:None despite a path traversal weakness, which is consistent with read-only traversal/file disclosure, yet the A:H rating implies the same primitive can also disrupt availability (for example by causing file inclusion of disruptive content or by exhausting resources) - defenders should treat the disclosure path as the most plausible exploitation primary, with availability impact as a secondary consequence. Overall this is a real priority for any WordPress site running Droip, though not a confirmed mass-exploitation event.

A remote attacker sends a crafted HTTP request to a Droip plugin endpoint on a public WordPress site, embedding traversal sequences in a file-or-template parameter to read sensitive files outside the plugin directory - for example wp-config.php to harvest database credentials and WordPress secret keys, which can then be pivoted into full site takeover. Because no authentication or user interaction is required and complexity is low, the attack can be scripted against large lists of WordPress hosts; no public exploit is identified at time of analysis, but the primitive is straightforward to reconstruct from the advisory.