CVE-2024-13550: The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' shortcode. This makes it possible for authenti

medium Affects abc-notation (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-01-25; advisory modified 2026-06-17.

The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' shortcode. This makes it possible for authenti

Package: abc-notation (WordPress plugin) WordPress
Affected versions: <=6.1.3
Fixed in: no fix recorded
Severity: medium CVSS 6.5
Exploitation: not on CISA KEV · EPSS 1% (51.7th percentile)
Published: 2025-01-25
Source: nvd

References

CWE-22

NVD record abc-notation (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-13551 medium The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the same package: abc-notation (WordPress plugin)
CVE-2020-11738 KEV high The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3. same weakness: CWE-22
CVE-2020-36193 KEV high Directory Traversal in Archive_Tar same weakness: CWE-22
CVE-2024-9047 critical The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all vers same weakness: CWE-22
CVE-2019-8943 medium WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has pri same weakness: CWE-22
CVE-2023-2745 medium WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, same weakness: CWE-22