Skip to content
OpenAdvisories
High · 8.6 CVE-2024-54291 EUVD-2024-54489GHSA-fmgc-85r6-v6q3

WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability

Published Mar 28, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.

Affected products

VendorProductAffectedFixed
labs64 PluginPass ≤ 0.9.10 —

References