Login Request a demo
Critical severity · published Oct 12, 2024
CVE-2024-9047
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
9.8
CVSS
93.3%
EPSS
No
On KEV
Description
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)93.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Iptanus File Upload · nickboss
through 4.24.11 · source: vendor
WF
Wordpress File Upload · Iptanus
before 4.24.12 · source: NVD, CISA
Affected product
IF
Iptanus File Upload
nickboss
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9047
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9047
Patch
https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve
More from Iptanus File Upload
9.8
CVE-2024-11635
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
9.8
CVE-2024-11613
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
7.5
CVE-2024-9939
WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
6.1
CVE-2024-7301
WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
4.3
CVE-2024-13494
WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details