CVE-2024-13671 is a path traversal vulnerability in the efreja Music Sheet Viewer WordPress plugin, specifically in the read_score_file() function. It allows unauthenticated attackers to perform arbitrary file reads on the server by bypassing pathname restrictions. This vulnerability affects all versions up to 4.1 and can lead to exposure of sensitive server files. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No patch or official remediation has been documented in the provided data. The vulnerability is publicly known and published but not yet confirmed to be exploited in the wild.

Successful exploitation of this vulnerability enables unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information such as configuration files, credentials, or other private data. This can compromise confidentiality but does not affect integrity or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official efreja or WordPress plugin security advisories for updates. No vendor-provided temporary fixes or mitigations are currently documented.