CVE-2024-12849 is a path traversal vulnerability (CWE-22) in the Error Log Viewer By WP Guru WordPress plugin, affecting all versions up to 1.0.1.3. The flaw exists in the wp_ajax_nopriv_elvwp_log_download AJAX action, which does not properly restrict pathname input, enabling unauthenticated attackers to read arbitrary files on the server. This arbitrary file read can disclose sensitive information stored on the server. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to its network attack vector, no required privileges or user interaction, and high confidentiality impact.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the affected server, potentially exposing sensitive information such as configuration files, credentials, or other private data. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider disabling or restricting access to the vulnerable AJAX action or the plugin itself to prevent exploitation.