Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2024-3107: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows aut...
CVE-2024-3107 · published 2 years ago
Summary
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files n...
What to do
- Update brainstormforce spectra to version 2.12.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| brainstormforce | spectra |
< 2.12.7 cpe:2.3:a:brainstormforce:spectra:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows aut...
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the server, which can contain sensitive information.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published2 May 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-3107 · NVD
Track software like this
Free during beta