Podsumowanie
WPIDE 3.5.3 exposes file-download and configuration endpoints that can be triggered over HTTP GET. Custom security middleware skips nonce verification for GET requests, which defeats CSRF protections for sensitive actions. The download path reads files relative to the wp-content directory, so an authenticated session can retrieve plugin, theme and upload contents. A companion configuration endpoint returns internal settings such as root paths and exclusion filters. The vendor changelog claimed earlier security fixes, but this GET-based vector remained active in 3.5.3 when tested on 9 February 2026.
Wpływ
An attacker who can leverage an authenticated WordPress session (directly or by inducing an administrator action via CSRF) can read arbitrary files under wp-content — including other plugins, themes and uploads — and obtain internal path and filter configuration useful for further attacks.
Rekomendacja naprawy
Validate nonces for every sensitive action regardless of HTTP method. Restrict download and configuration routes to POST. Enforce strict path validation so requested files cannot leave the intended directory.
Dlaczego bez CVE
No public CVE identifier has been assigned yet. Documented here after local verification; exploit URLs and payloads are withheld from the public site.