Read the docs
TI-2024-06089 Aliases CVE-2024-6567GHSA-xwpx-xxx9-g4xw

Ebook Store <= 5.8001 - Unauthenticated Full Path Disclosure

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fpdi-protection and not preventing direct access to test files that have display_errors set to true. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. The plugin vendor removed the test files, however, did not increment the version meaning this is inadequately patched in the same version that is affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00448 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
motovnetEbook Storeup to 5.8001—No fix listedCNA
  • Ebook Store Vendormotovnet Affected up to 5.8001 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:shopfiles:ebook_store:*:*:*:*:*:wordpress:*:*up to 5.8001Vulnerablemotovnet
  • cpe:2.3:a:shopfiles:ebook_store:*:*:*:*:*:wordpress:*:* Versions up to 5.8001 Vulnerable ·motovnet

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6567
  2. 2026-10-03 Alias added: GHSA-xwpx-xxx9-g4xw

References

Advisory 1

Other 3

  • TI-2025-07420 Ebook Store < 5.8015 - Reflected XSS via $_SERVER['REQUEST_URI'] CVSS 3.1MEDIUM 6.1
  • TI-2023-08876 WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-24405 WordPress Ebook Store Plugin <= 5.785 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
  • TI-2024-11373 Ebook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step' CVSS 3.1MEDIUM 6.1
  • TI-2024-10457 Ebook Store <= 5.8001 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-08865 WordPress Ebook Store Plugin <= 5.775 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences