published April 25, 2022
⚠️ A sneaky oversight in the Cab fare calculator plugin could let attackers read any file they like — not great for your security! Think of it like a restaurant chef who accepts orders without checking the recipe list — they might accidentally serve something entirely inappropriate! In this case, the plugin trusts a parameter without ensuring it’s safe, leading to potential file exposure. An attacker could exploit this Local File Inclusion vulnerability to access sensitive files on your server, potentially revealing user data or critical system configurations. While it hasn't been widely exploited, the risk of an unwelcome peek into your files makes it a concern worth addressing immediately.
Think of it like a restaurant chef who accepts orders without checking the recipe list — they might accidentally serve something entirely inappropriate! In this case, the plugin trusts a parameter without ensuring it’s safe, leading to potential file exposure. The Cab fare calculator WordPress plugin versions prior to 1.0.4 fail to validate the 'controller' parameter used in require statements, allowing unauthorized access to local files.
An attacker could exploit this Local File Inclusion vulnerability to access sensitive files on your server, potentially revealing user data or critical system configurations. While it hasn't been widely exploited, the risk of an unwelcome peek into your files makes it a concern worth addressing immediately. Update the Cab fare calculator plugin to version 1.0.4 or later to fix this issue. Additionally, review your security settings to ensure that local files cannot be inadvertently accessed. Don't forget to regularly audit your plugins for vulnerabilities! You've got this! Fixing this vulnerability is an easy win for your security hygiene. 🛡️