CVE-2024-8104 is a directory traversal vulnerability (CWE-22) in The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, affecting all versions up to and including 3.0.8. The flaw exists in the download_file_ajax function, allowing authenticated users with subscriber privileges or higher to read arbitrary files on the server by manipulating file path inputs. This can lead to disclosure of sensitive server information. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no patch or remediation details are provided in the current data.

An attacker with at least subscriber-level access can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, credentials, or other protected information. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. This could lead to further compromise depending on the data accessed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict subscriber-level access where possible and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges to users. Follow updates from the plugin vendor or WordPress security advisories for official fixes.