CVE-2024-6567 is a Full Path Disclosure vulnerability in the motovnet Ebook Store WordPress plugin (versions up to 5.8001). The issue arises from the presence of test files with PHP error display enabled (display_errors=true) that are accessible without authentication. This exposure reveals the full filesystem path of the web application, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Although the vendor removed the test files, the version number was not incremented, indicating the patch is inadequately applied in the same version. The disclosed path information can facilitate further attacks if other vulnerabilities exist.

The vulnerability exposes the full filesystem path of the web application to unauthenticated attackers, which is sensitive information that can aid in further exploitation. However, the information disclosed does not directly compromise confidentiality, integrity, or availability by itself. No known exploits are reported in the wild. The medium CVSS score reflects limited impact without additional vulnerabilities.

Patch status is not yet confirmed as the vendor removed the test files but did not release a new version, resulting in an inadequately patched state. Users should verify with the vendor for an official fixed version or apply manual mitigations such as removing or restricting access to test files with display_errors enabled. Until an official fix is released, restricting access to these files or disabling error display in production environments is recommended.