CVE-2024-10672: Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to delete limited files on the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10672?
CVE-2024-10672 is considered to have a medium severity level due to the potential for unauthorized file deletion.
How do I fix CVE-2024-10672?
To fix CVE-2024-10672, update the Multiple Page Generator Plugin to version 4.0.3 or later, which addresses the vulnerability.
Who is affected by CVE-2024-10672?
All users of the Multiple Page Generator Plugin for WordPress running versions up to and including 4.0.2 are affected by CVE-2024-10672.
What type of vulnerability is CVE-2024-10672?
CVE-2024-10672 is an arbitrary file deletion vulnerability caused by insufficient file path validation.
What function is related to CVE-2024-10672?
The vulnerability in CVE-2024-10672 is related to the mpg_upsert_project_source_block() function within the plugin.