by Kastro
Paper/Archive/CVE-2024-11635

CVE-2024-11635

nickboss Iptanus File Upload — WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.6.736 × 2014.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.

Affected

ProductAffectedFixed inSource
Iptanus File Upload≤ 4.24.12–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/b5165f60-6515-4a2c-a124-cc88155eaf01?source=cverefplugins.svn.wordpress.org/wp-file-upload/trunk/wfu_file_downloader.phprefabrahack.com/posts/wp-file-upload-rce-part1