CVE-2024-9224 is a path traversal vulnerability (CWE-22) in the kau-boy Hello World WordPress plugin. It allows authenticated attackers with subscriber-level privileges or above to read arbitrary files on the server via the hello_world_lyric() function. This improper limitation of pathname access can expose sensitive server information. The vulnerability affects all versions up to 2.1.1. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact. No patch or vendor advisory is currently available.

An attacker with subscriber-level access or higher can exploit this vulnerability to read arbitrary files on the server. This can lead to disclosure of sensitive information stored on the server, potentially compromising confidentiality. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files in locations accessible by the plugin. Follow updates from the vendor for a security patch.