CVE-2024-13471 is a path traversal vulnerability (CWE-22) in the DesignThemes Core Features WordPress plugin. The issue arises from the absence of a capability check in the dt_process_imported_file function, enabling unauthenticated remote attackers to access arbitrary files on the server. This vulnerability affects all versions up to and including 4.7. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality without affecting integrity or availability.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the vulnerable plugin, potentially exposing sensitive information. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin functionality if possible, and monitor for updates from the vendor. Avoid exposing the WordPress installation to untrusted networks or users to reduce risk.