IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
CVSS 3.1HIGH 7.2·Network·High privileges·No interaction·EPSS 0.01061·Published 2023-12-18·Fixed in 3.4.2.1CWE-22
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
CVSS 3.1MEDIUM 5.3·Network·No auth·No interaction·EPSS 0.18552·Published 2023-12-18·Fixed in 3.4.2.1
