CVE-2024-13535 is a vulnerability classified under CWE-209 (Generation of Error Message Containing Sensitive Information) found in the Actionwear products sync plugin for WordPress, versions up to and including 2.3.0. The root cause is that the composer-setup.php file is publicly accessible and configured with 'display_errors' set to true, which causes detailed error messages to be shown to unauthenticated users. This results in full path disclosure of the web application’s directory structure. Full path disclosure can aid attackers by revealing the underlying file system layout, which can be leveraged to craft more effective attacks such as local file inclusion, directory traversal, or privilege escalation when combined with other vulnerabilities. The vulnerability does not directly allow code execution, data modification, or denial of service, but it lowers the attacker's effort in reconnaissance. The CVSS v3.1 score is 5.3 (medium), reflecting the ease of exploitation (network, no privileges, no user interaction) but limited impact (confidentiality only, no integrity or availability impact). No known exploits have been reported in the wild, and no patches have been linked yet. The vulnerability was publicly disclosed in February 2025 and assigned by Wordfence.

The primary impact of this vulnerability is information disclosure, specifically revealing the full file system path of the WordPress installation. While this does not directly compromise confidentiality of sensitive user data or system integrity, it provides attackers with valuable intelligence that can be used to identify other vulnerabilities or misconfigurations. For organizations, this can increase the risk of targeted attacks such as remote code execution or privilege escalation if other weaknesses exist. The vulnerability does not affect availability and does not require authentication or user interaction, making it accessible to any remote attacker. The overall risk is moderate but can be significant in environments where multiple vulnerabilities coexist or where attackers are conducting reconnaissance for more complex attacks.

To mitigate this vulnerability, organizations should immediately restrict public access to the composer-setup.php file and any other sensitive setup or configuration files. This can be done by removing these files from the web root after installation or by configuring web server rules (e.g., .htaccess or nginx config) to deny access. Additionally, the 'display_errors' PHP setting should be disabled (set to 'Off') in production environments to prevent error messages from being shown to users. Updating the plugin to a patched version when available is recommended. In the meantime, monitoring web server logs for attempts to access composer-setup.php and other sensitive files can help detect reconnaissance activity. Employing a Web Application Firewall (WAF) to block suspicious requests targeting known vulnerable paths can further reduce risk. Regular security audits and vulnerability scanning of WordPress plugins should be part of the security hygiene to detect similar issues proactively.