CVE-2024-7410 is a Full Path Disclosure vulnerability in the esthertyler My Custom CSS PHP & ADS WordPress plugin (up to version 3.3). The issue arises because the plugin does not prevent direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file, which reveals the full filesystem path of the web application. This exposure can aid attackers in further exploitation but does not directly compromise confidentiality, integrity, or availability on its own. The vulnerability is unauthenticated and remotely exploitable over the network.

An unauthenticated attacker can obtain the full filesystem path of the affected web application. This information disclosure is limited in impact and does not directly expose sensitive data or allow system compromise. However, it can facilitate other attacks if additional vulnerabilities are present. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict direct access to the vulnerable PHP file by implementing web server rules (e.g., deny access via .htaccess or equivalent) or removing the file if not needed. Monitor vendor channels for updates and apply patches promptly once available.