CVE-2024-12849

CVE-2024-12849 is an unauthenticated arbitrary file read (path traversal, CWE-22) in the Error Log Viewer By WP Guru plugin for WordPress, affecting all versions up to and including 1.0.1.3. The flaw is triggered through the wp_ajax_nopriv_elvwp_log_download AJAX action, which is registered for unauthenticated visitors, so an attacker can send crafted requests to the site's admin-ajax.php endpoint and traverse outside the intended log path without any credentials or user interaction. A successful attack lets the attacker read the contents of arbitrary files on the web server, potentially exposing configuration files or other data containing sensitive information such as credentials. Any WordPress site running the plugin at version 1.0.1.3 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is currently known and the flaw is not yet in CISA's KEV catalog, but EPSS assigns a 46.9% probability of exploitation within 30 days, so defenders should expect exploitation attempts.

What to do: Update the Error Log Viewer By WP Guru plugin to the newest available release (any version later than 1.0.1.3); if no patched release is available, deactivate or remove the plugin. As an interim mitigation, block unauthenticated requests to admin-ajax.php with action=elvwp_log_download, or apply a WAF rule rejecting path-traversal patterns in that request. Review access logs for hits on this endpoint and, if suspicious activity is found, determine whether sensitive files such as configuration files were read and rotate any credentials they contain.