CVE-2024-7411 is a vulnerability in the contrid Newsletters WordPress plugin (versions up to 4.9.9) that allows unauthenticated users to access the /vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file directly. This access results in full path disclosure of the web application, which is sensitive information that can aid attackers in further exploitation. The vulnerability is due to the plugin not restricting direct access to this file. The disclosed path information does not itself compromise confidentiality, integrity, or availability but may facilitate other attacks if combined with additional vulnerabilities.

The impact is limited to the disclosure of the full file system path of the web application. This information leak is classified as a confidentiality issue with low impact on confidentiality (CVSS impact score C:L). There is no impact on integrity or availability. The disclosed information alone is not sufficient to compromise the system but can be leveraged in multi-stage attacks if other vulnerabilities are present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting direct access to the affected PHP file via web server configuration (e.g., .htaccess rules or equivalent) to prevent unauthorized access. Monitor vendor channels for updates and apply any official patches once released.