CVE-2023-1478: Hummingbird < 3.4.2 - Unauthenticated Path Traversal

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-04-10 · updated 2026-06-17
Weakness: CWE-22

Description

The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.

Affected products

WPMU DEV - Your All-in-One WordPress Platform Hummingbird: before 3.4.2 — fixed in 3.4.2

How to fix

Upgrade to a fixed version: WPMU DEV - Your All-in-One WordPress Platform Hummingbird 3.4.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/512a9ba4-01c0-4614-a991-efdc7fe51abe
https://wpscan.com/vulnerability/512a9ba4-01c0-4614-a991-efdc7fe51abe

Get alerted when CVE-2023-1478 or the next vulnerability affects your stack