What’s Vulnerable › Vulnerabilities

CVE-2024-8352: Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-03 · updated 2026-06-17
• Weakness: CWE-22

Description

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

• dejanmarkovic Social Web Suite – Social Media Auto Post, Social Media Auto Publish: before 4.1.12 — fixed in 4.1.12

How to fix

Upgrade to a fixed version: dejanmarkovic Social Web Suite – Social Media Auto Post, Social Media Auto Publish 4.1.12. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/libs/class-socialwebsuite-log.php#L78
• https://plugins.trac.wordpress.org/changeset/3155593/social-web-suite/trunk?old=3068377&old_path=%2Fsocial-web-suite%2Ftrunk
• https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=cve

Get alerted when CVE-2024-8352 or the next vulnerability affects your stack