CVE-2024-6549 is an information disclosure vulnerability classified under CWE-200 affecting the Admin Post Navigation WordPress plugin developed by coffee2code. The root cause is the presence of test files left in the plugin that have PHP's display_errors directive enabled, which reveals the full filesystem path of the web server hosting the WordPress site. This vulnerability exists in all plugin versions up to and including 2.1. An unauthenticated attacker can trigger error messages that disclose the absolute path to the web application directory. While the disclosed information alone does not allow direct compromise, it can be leveraged to facilitate other attacks such as local file inclusion, path traversal, or targeted exploitation of other vulnerabilities by providing attackers with precise directory structure knowledge. The vulnerability does not impact integrity or availability directly and requires no privileges or user interaction to exploit. No public exploits have been reported yet, but the presence of this information leakage increases the attack surface and risk for affected sites. The CVSS 3.1 base score is 5.3, reflecting a medium severity level due to the ease of exploitation and the limited impact of the disclosed information alone.

The primary impact of CVE-2024-6549 is the exposure of sensitive internal information about the web server's directory structure. This information can significantly aid attackers in crafting more effective attacks, such as local file inclusion, remote code execution, or privilege escalation, especially if other vulnerabilities exist on the same system. Organizations running the vulnerable plugin may face increased risk of targeted attacks and exploitation chains. Although the vulnerability itself does not allow direct compromise, it lowers the barrier for attackers to identify and exploit other weaknesses. This can lead to data breaches, website defacement, or service disruption if combined with additional vulnerabilities. The impact is particularly relevant for websites with sensitive data or critical business functions relying on WordPress and this plugin.

To mitigate CVE-2024-6549, organizations should immediately update the Admin Post Navigation plugin to a version where this issue is fixed once available. Until a patch is released, administrators should manually remove or disable any test files that enable display_errors or other debugging features within the plugin directory. Additionally, configuring the PHP environment to disable display_errors on production servers is critical to prevent information leakage. Web application firewalls (WAFs) can be configured to block requests that trigger error messages or access test files. Regular security audits and vulnerability scanning should be performed to detect such information disclosures. Monitoring logs for suspicious requests targeting plugin files can help identify exploitation attempts. Finally, reducing the attack surface by limiting plugin usage to only necessary components and following WordPress security best practices will help mitigate risk.