CVE-2024-10960: Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10960?
CVE-2024-10960 is considered a high severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-10960?
To fix CVE-2024-10960, update the Brizy Page Builder plugin to version 2.6.5 or later.
Who is affected by CVE-2024-10960?
CVE-2024-10960 affects authenticated users with Contributor-level access on all versions of the Brizy Page Builder plugin up to and including 2.6.4.
What is the impact of CVE-2024-10960?
The impact of CVE-2024-10960 could allow attackers to upload malicious files to the WordPress site, potentially leading to further exploits.
Is CVE-2024-10960 exploitable without authentication?
No, CVE-2024-10960 requires authentication, meaning it cannot be exploited by unauthenticated users.