The crmperks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms WordPress plugin versions up to 1.4.4 suffer from a full path disclosure vulnerability. This vulnerability enables unauthenticated attackers to retrieve the full filesystem path of the web application. The disclosed path information is considered sensitive as it can assist attackers in crafting further exploits, although it does not directly lead to data compromise or service disruption by itself. The vulnerability is tracked as CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. A patch is available to remediate this issue.

An unauthenticated attacker can obtain the full filesystem path of the affected web application. This information disclosure does not directly compromise confidentiality, integrity, or availability but may aid attackers in mounting further attacks if other vulnerabilities exist. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. It is recommended to update the crmperks Integration plugin to a version later than 1.4.4 where this issue is fixed. No additional mitigation steps are indicated by the vendor advisory.