The vulnerability CVE-2024-12719 in the nickboss Iptanus File Upload WordPress plugin is due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function. This allows authenticated users with low privileges (Subscriber-level and above) to perform limited path traversal to enumerate directories and subdirectories within the WordPress environment. The flaw does not permit viewing of file contents, only directory listings. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and limited confidentiality impact. The vulnerability affects all versions up to and including 4.24.15. There is no vendor advisory or patch information provided, and no known exploits have been reported.

The impact is limited to unauthorized disclosure of directory and subdirectory structures within WordPress installations using the vulnerable plugin. This could aid an attacker in reconnaissance but does not expose file contents or allow modification or denial of service. The confidentiality impact is low, and integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor plugin updates from nickboss for a security patch addressing this missing authorization check.