{"id":"CVE-2024-32111","aliases":["BIT-wordpress-2024-32111","BIT-wordpress-multisite-2024-32111","EUVD-2024-29933","GHSA-6j7w-22rc-9895","UBUNTU-CVE-2024-32111"],"status":"published","title":"WordPress core \u003c 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00478,"percentile":0.41638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-06-25T13:35:45Z","modified":"2026-06-17T07:29:17Z","fixes":[{"ecosystem":"Bitnami","package":"wordpress","fixed_in":["4.1.41","4.2.38","4.3.34","4.4.33","4.5.32","4.6.29","4.7.29","4.8.25","4.9.26","5.0.22","5.1.19","5.2.21","5.3.18","5.4.16","5.5.15","5.6.14","5.7.12","5.8.10","5.9.10","6.0.9","6.1.7","6.2.6","6.3.5","6.4.5","6.5.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"wordpress-multisite","fixed_in":["4.1.41","4.2.38","4.3.34","4.4.33","4.5.32","4.6.29","4.7.29","4.8.25","4.9.26","5.0.22","5.1.19","5.2.21","5.3.18","5.4.16","5.5.15","5.6.14","5.7.12","5.8.10","5.9.10","6.0.9","6.1.7","6.2.6","6.3.5","6.4.5","6.5.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"wordpress","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.41"},{"introduced":"4.2.0"},{"fixed":"4.2.38"},{"introduced":"4.3.0"},{"fixed":"4.3.34"},{"introduced":"4.4.0"},{"fixed":"4.4.33"},{"introduced":"4.5.0"},{"fixed":"4.5.32"},{"introduced":"4.6.0"},{"fixed":"4.6.29"},{"introduced":"4.7.0"},{"fixed":"4.7.29"},{"introduced":"4.8.0"},{"fixed":"4.8.25"},{"introduced":"4.9.0"},{"fixed":"4.9.26"},{"introduced":"5.0.0"},{"fixed":"5.0.22"},{"introduced":"5.1.0"},{"fixed":"5.1.19"},{"introduced":"5.2.0"},{"fixed":"5.2.21"},{"introduced":"5.3.0"},{"fixed":"5.3.18"},{"introduced":"5.4.0"},{"fixed":"5.4.16"},{"introduced":"5.5.0"},{"fixed":"5.5.15"},{"introduced":"5.6.0"},{"fixed":"5.6.14"},{"introduced":"5.7.0"},{"fixed":"5.7.12"},{"introduced":"5.8.0"},{"fixed":"5.8.10"},{"introduced":"5.9.0"},{"fixed":"5.9.10"},{"introduced":"6.0.0"},{"fixed":"6.0.9"},{"introduced":"6.1.0"},{"fixed":"6.1.7"},{"introduced":"6.2.0"},{"fixed":"6.2.6"},{"introduced":"6.3.0"},{"fixed":"6.3.5"},{"introduced":"6.4.0"},{"fixed":"6.4.5"},{"introduced":"6.5.0"},{"fixed":"6.5.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"wordpress-multisite","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.41"},{"introduced":"4.2.0"},{"fixed":"4.2.38"},{"introduced":"4.3.0"},{"fixed":"4.3.34"},{"introduced":"4.4.0"},{"fixed":"4.4.33"},{"introduced":"4.5.0"},{"fixed":"4.5.32"},{"introduced":"4.6.0"},{"fixed":"4.6.29"},{"introduced":"4.7.0"},{"fixed":"4.7.29"},{"introduced":"4.8.0"},{"fixed":"4.8.25"},{"introduced":"4.9.0"},{"fixed":"4.9.26"},{"introduced":"5.0.0"},{"fixed":"5.0.22"},{"introduced":"5.1.0"},{"fixed":"5.1.19"},{"introduced":"5.2.0"},{"fixed":"5.2.21"},{"introduced":"5.3.0"},{"fixed":"5.3.18"},{"introduced":"5.4.0"},{"fixed":"5.4.16"},{"introduced":"5.5.0"},{"fixed":"5.5.15"},{"introduced":"5.6.0"},{"fixed":"5.6.14"},{"introduced":"5.7.0"},{"fixed":"5.7.12"},{"introduced":"5.8.0"},{"fixed":"5.8.10"},{"introduced":"5.9.0"},{"fixed":"5.9.10"},{"introduced":"6.0.0"},{"fixed":"6.0.9"},{"introduced":"6.1.0"},{"fixed":"6.1.7"},{"introduced":"6.2.0"},{"fixed":"6.2.6"},{"introduced":"6.3.0"},{"fixed":"6.3.5"},{"introduced":"6.4.0"},{"fixed":"6.4.5"},{"introduced":"6.5.0"},{"fixed":"6.5.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]}],"products":[{"vendor":"automattic","product":"wordpress"},{"vendor":"wordpress foundation","product":"wordpress"}],"references":[{"url":"https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","web","report"]},{"url":"https://wordpress.org/news/2024/06/wordpress-6-5-5/","tags":["release-notes","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32111","tags":["web"]},{"url":"https://wordpress.org/news/2024/06/wordpress-6-5-5"},{"url":"https://github.com/advisories/GHSA-6j7w-22rc-9895"},{"url":"https://ubuntu.com/security/CVE-2024-32111","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32111","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-32111","title":"WordPress core \u003c 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-25T13:35:45.596Z","modified":"2026-04-28T16:09:34.172Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:15.662528Z"}],"euvd":[{"id":"EUVD-2024-29933","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-25T13:35:45Z","modified":"2026-04-28T16:09:34Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:06:06.168321Z"}],"ghsa":[{"id":"GHSA-6j7w-22rc-9895","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-25T15:31:08Z","modified":"2024-06-25T15:31:12Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:57:31.517228Z"}],"nvd":[{"id":"CVE-2024-32111","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-25T14:15:11.63Z","modified":"2026-06-17T07:29:17.987Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"UBUNTU-CVE-2024-32111","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-25T14:15:00Z","modified":"2025-10-24T05:09:10Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"BIT-wordpress-2024-32111","title":"WordPress core \u003c 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-27T07:43:09.753Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:36.455807Z"},{"id":"BIT-wordpress-multisite-2024-32111","title":"WordPress core \u003c 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.","status":"published","published":"2024-06-27T07:41:57.553Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:36.455807Z"}]}}