Login Request a demo
Critical severity · published Jan 8, 2025
CVE-2024-11613
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
9.8
CVSS
4.4%
EPSS
No
On KEV
Description
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Iptanus File Upload · nickboss
through 4.24.15 · source: vendor
WF
Wordpress File Upload · Iptanus
before 4.25.0 · source: NVD
Affected product
IF
Iptanus File Upload
nickboss
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11613
abrahack.com
https://abrahack.com/posts/wp-file-upload-rce-part2/
Product
https://plugins.svn.wordpress.org/wp-file-upload/trunk/wfu_file_downloader.php
Patch
https://plugins.trac.wordpress.org/changeset/3217005/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/31052fe6-a0ae-4502-b2d2-dbc3b3bf672f?source=cve
More from Iptanus File Upload
9.8
CVE-2024-11635
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
9.8
CVE-2024-9047
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
7.5
CVE-2024-9939
WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
4.3
CVE-2024-13494
WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
4.3
CVE-2024-12719
WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal