/Vulnerability Library

Campaign Monitor for WordPress - Information Disclosure

CVE-2024-6569
Verified

Description

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled display_errors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires display_errors to be enabled.

Severity

Medium

CVSS Score

5.3

Exploit Probability

1%

Published Date

June 15, 2026

Template Author

aushack

CVE-2024-6569.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2024-6569
CWE ID:
cwe-200

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/forms-for-campaign-monitor/campaign-monitor-for-wordpress-2815-unauthenticated-full-path-disclosurehttps://wordpress.org/plugins/forms-for-campaign-monitor/https://nvd.nist.gov/vuln/detail/CVE-2024-6569

Remediation Steps

Update to the latest version of the plugin where the issue is fixed, or disable display_errors and restrict access to the affected file.