CVE-2024-6549 is a vulnerability in the coffee2code Admin Post Navigation WordPress plugin (up to version 2.1) that results in full path disclosure. The issue arises from the plugin using bootstrap and leaving test files with PHP's display_errors enabled, which can be accessed by unauthenticated attackers. This exposure reveals the full filesystem path of the web application. Although this information disclosure does not directly compromise confidentiality, integrity, or availability, it can facilitate further attacks if other vulnerabilities exist on the affected site. There is no indication of known exploits in the wild or an official patch at this time.

An unauthenticated attacker can obtain the full filesystem path of the web application by accessing test files with display_errors enabled. This information disclosure is classified as a CWE-200 exposure of sensitive information. The disclosed data alone does not lead to direct compromise but may aid attackers in crafting more effective attacks if other vulnerabilities are present. The vulnerability does not impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing test files and ensure that PHP error display settings (display_errors) are disabled in production environments to prevent information leakage.