Now officially on WordPress.org

CVE Database / CVE-2024-3107

CVE · Medium

CVE-2024-3107 — Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] < 2.12.7

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-3107 Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] < 2.12.7 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Medium 4.3 < 2.12.7 2.12.7 2024-04-26 —

CVE-2024-3107

The Spectra – WordPress Gutenberg Blocks plugin contains a path traversal vulnerability in its get_block_default_attributes function that affects versions up to 2.12.6. Users with contributor access or higher permissions can exploit this flaw to access and read the contents of attributes.php files stored anywhere on the server, potentially exposing sensitive data. The vulnerability requires authentication and was fixed in version 2.12.7.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings