CVE-2024-7410 (GCVE-0-2024-7410)
Vulnerability from cvelistv5 – Published: 2024-08-09 09:30 – Updated: 2026-04-08 17:25
VLAI
Title
My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure
Summary
The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file displaying/generating the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| esthertyler | My Custom CSS PHP & ADS |
Affected:
0 , ≤ 3.3
(semver)
|
|
| esthertyler | my_custom_css_php_\&_ads |
Affected:
0 , ≤ 3.3
(custom)
cpe:2.3:a:esthertyler:my_custom_css_php_\&_ads:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:esthertyler:my_custom_css_php_\\\u0026_ads:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "my_custom_css_php_\\\u0026_ads",
"vendor": "esthertyler",
"versions": [
{
"lessThanOrEqual": "3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T14:46:18.530232Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T14:48:40.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "My Custom CSS PHP \u0026 ADS",
"vendor": "esthertyler",
"versions": [
{
"lessThanOrEqual": "3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthew Rollings"
}
],
"descriptions": [
{
"lang": "en",
"value": "The My Custom CSS PHP \u0026 ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file displaying/generating the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:25:07.701Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d145d0af-e364-4cc3-af4f-03117eb34637?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/my-custom-css/trunk/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-08T20:34:54.000Z",
"value": "Disclosed"
}
],
"title": "My Custom CSS PHP \u0026 ADS \u003c= 3.3 - Unauthenticated Full Path Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-7410",
"datePublished": "2024-08-09T09:30:13.563Z",
"dateReserved": "2024-08-02T12:27:06.012Z",
"dateUpdated": "2026-04-08T17:25:07.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-7410",
"date": "2026-06-07",
"epss": "0.00263",
"percentile": "0.49932"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-7410\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2024-08-12T13:38:41.910\",\"lastModified\":\"2024-08-12T13:41:36.517\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The My Custom CSS PHP \u0026 ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file displaying/generating the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.\"},{\"lang\":\"es\",\"value\":\"El complemento My Custom CSS PHP \u0026amp; ADS para WordPress es vulnerable a la divulgaci\u00f3n de ruta completa en todas las versiones hasta la 3.3 incluida. Esto se debe a que el complemento no impide el acceso directo al archivo /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php y al archivo que muestra/genera la ruta completa. Esto hace posible que atacantes no autenticados recuperen la ruta completa de la aplicaci\u00f3n web, que puede usarse para ayudar en otros ataques. La informaci\u00f3n mostrada no es \u00fatil por s\u00ed sola y requiere que est\u00e9 presente otra vulnerabilidad para da\u00f1ar un sitio web afectado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://plugins.trac.wordpress.org/browser/my-custom-css/trunk/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/d145d0af-e364-4cc3-af4f-03117eb34637?source=cve\",\"source\":\"security@wordfence.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-7410\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-13T14:46:18.530232Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:esthertyler:my_custom_css_php_\\\\\u0026_ads:*:*:*:*:*:*:*:*\"], \"vendor\": \"esthertyler\", \"product\": \"my_custom_css_php_\\\\\u0026_ads\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"3.3\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-13T14:48:33.812Z\"}}], \"cna\": {\"title\": \"My Custom CSS PHP \u0026 ADS \u003c= 3.3 - Unauthenticated Full Path Disclosure\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Matthew Rollings\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"esthertyler\", \"product\": \"My Custom CSS PHP \u0026 ADS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.3\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-08-08T20:34:54.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/d145d0af-e364-4cc3-af4f-03117eb34637?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/my-custom-css/trunk/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The My Custom CSS PHP \u0026 ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file displaying/generating the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-04-08T17:25:07.701Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-7410\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-08T17:25:07.701Z\", \"dateReserved\": \"2024-08-02T12:27:06.012Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2024-08-09T09:30:13.563Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…