by Kastro
Paper/Archive/CVE-2024-9307

CVE-2024-9307

themelooks mFolio Lite — mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files

EPSS 1.0%CVSS 9.9
critical.is priorityof 100
42
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 61.7.617 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file or upload arbitrary EXE files on the affected site's server which may make remote code execution possible if the attacker can also gain access to run the .exe file, or trick a site visitor into downloading and running the .exe file.

Affected

ProductAffectedFixed inSource
mFolio Lite≤ 1.2.1–CNA
mfolio_lite≤ 1.2.1–CISA-ADP

Scores by source

Wordfence (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/3b4012dd-7c0a-45f1-8ada-8f9dc6867e1e?source=cverefwordpress.org/plugins/mfolio-lite/#developersrefplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3195835%40mfolio-lite%2Ftrunk&old=2792814%40mfolio-lite%2Ftrunk